refactor(secrets): drop scope-aware env shims; runtime_provider and the voice/xai tools read the canonical getters

hermes_cli/runtime_provider._getenv was a 4-line copy of get_secret(name,
default) or default; it becomes agent.secret_scope.get_secret_str (returns
default only when the secret is genuinely unset, still raises
UnscopedSecretError — a child's unscoped read is a spawn-site bug). The
runtime_provider_backends/_custom siblings call it directly instead of via
the origin module.

tools/tts_tool, tools/transcription_tools and tools/xai_http each carried an
identical get_env_value re-export kept "so tests can patch" it; the seam is
hermes_cli.config.get_env_value, read lazily at call time. Callers
(tts_streaming, tts_tool_providers, transcription_cloud, voice_client_config,
tools_config) go there directly; resolve_provider_secret already defaults to
it so the env_getter kwarg is gone. Tests repointed at the canonical; the two
tests that only proved the shim forwarded are deleted.

Behavior change: none.

tests/tools/test_tts_pythonpath_fallback.py

@@ -139,7 +139,7 @@ class TestMistralSttPythonpathFallback:
             "mistralai.client": mock_mistralai,
         }), patch("tools.lazy_deps.ensure",
                   side_effect=FeatureUnavailable("stt.mistral", (), "test")), \
-             patch("tools.transcription_tools.get_env_value",
+             patch("hermes_cli.config.get_env_value",
                    return_value="test-key"):
             result = _transcribe_mistral(str(audio_file), "mistral-large-latest")