hermes-agent: restore packaged-install parity - #297394

• Have you followed the guidelines for contributing?
• Have you ensured that your commits follow the commit style guide?
• Have you checked that there aren't other open pull requests for the same formula update/change?
• Have you built your formula locally with HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>?
• Is your test running fine brew test <formula>?
• Does your build pass brew audit --strict <formula> (after doing HOMEBREW_NO_INSTALL_FROM_API=1 brew install --build-from-source <formula>)? If this is a new formula, does it pass brew audit --new <formula>?

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

AI-assisted contribution by Claude Code (Claude Fable 5, model claude-fable-5) for ~95% of the work (upstream packaging research, formula change, and running the validation). Build, test and audit were executed by the AI on the contributor's machine; the contributor reviewed the design, the diff and this description.

Built and tested locally on macOS 26 (Tahoe) running arm64, and on Linux arm64 from source in the homebrew/brew Docker container.

Draft until #297327 lands — the first commit here is that PR's; this branch will be rebased exactly once after it merges, before being marked ready.

Restores packaged-install parity with upstream's own Nix packaging (nix/hermes-agent.nix — the env-var wrapper interface upstream kept for packaged installs after removing brew/PyPI as channels in NousResearch/hermes-agent#68217). Today's brew install ships no bundled skills/plugins/locales, no web dashboard, no TUI, and hermes self-downloads node/ripgrep into ~/.hermes (and tirith from GitHub releases) at runtime.

What this change does:

• Ships the bundled data dirs (skills, optional-skills, plugins, locales, optional-mcps) into pkgshare, pruned like Nix's source filters.
• Builds the web dashboard (web/, vite) and TUI (ui-tui/, esbuild) with npm at build time — same as upstream's nix/web.nix / nix/tui.nix. First npm-registry access for this formula; bottles grow roughly 25 MB.
• Wraps hermes, hermes-agent, hermes-acp with the same ten HERMES_* env vars the Nix wrapper sets.
• Adds node, ripgrep, tirith as runtime deps, replacing the runtime self-downloads; hermes doctor flips ripgrep/Node to ✓. ffmpeg stays optional via caveats. (node rather than node@22: upstream pins for reproducibility, not compatibility; node@22 is the fallback if CI disagrees.)
• revision 1 so bottles rebuild with the new payload.

Test rationale: assert_match "bundled", shell_output("#{bin}/hermes plugins list") exercises the wrapper env mechanism directly and discriminates: via the bare venv entry point it matches 0 times; via the wrapper, 89. (skills list couldn't be used — bundled-skill seeding only runs in interactive setup/update flows, not under brew test's isolated $HOME.)