fix(copilot-acp): honor the fetch_models None-on-failure contract; bound the probe budget; refresh-proof the memo

Gate findings on the #108614 salvage (2c + simplify-code):
- CopilotACPProfile.fetch_models promised None on failure but raised (AuthError on a
  missing CLI, RuntimeError/TimeoutError from the probe) — only the caller in
  hermes_cli/models.py caught it; any other caller got exceptions. Wrap the body and
  return None so the docstring and the base ProviderProfile.fetch_models contract hold.
- timeout_seconds was a PER-REQUEST budget (initialize + session/new each got the full
  timeout => ~30s worst-case foreground stall on a hung CLI). One shared session deadline.
- /model --refresh (clear_provider_models_cache) wiped the disk cache but not the new
  session memo, so a fresh CLI login stayed stale for 5 min past an explicit refresh.
- A failed probe is now memoized for 30s instead of the full 5 min, so signing in to
  the CLI is picked up on the next switch.
- _fresh_acp_memo fixture restores the memo on teardown — no cross-test state leak.

plugins/model-providers/copilot-acp/__init__.py

@@ -33,13 +33,18 @@ class CopilotACPProfile(ProviderProfile):
         """
         from hermes_cli.auth import resolve_external_process_provider_credentials
 
-        creds = resolve_external_process_provider_credentials(self.name)
-        if not str(creds.get("base_url") or "").startswith("acp://"):
+        try:
+            creds = resolve_external_process_provider_credentials(self.name)
+            if not str(creds.get("base_url") or "").startswith("acp://"):
+                return None
+            client = self.create_client(
+                api_key=creds.get("api_key"), base_url=creds.get("base_url"),
+                command=creds.get("command"), args=creds.get("args"))
+            return client.list_models(timeout_seconds=timeout) or None
+        except Exception:
+            # Missing CLI (AuthError), refused --acp / failed spawn (RuntimeError), probe
+            # timeout — the base fetch_models contract is "None if the fetch failed".
             return None
-        client = self.create_client(
-            api_key=creds.get("api_key"), base_url=creds.get("base_url"),
-            command=creds.get("command"), args=creds.get("args"))
-        return client.list_models(timeout_seconds=timeout) or None
 
 
 copilot_acp = CopilotACPProfile(