feat(app): embed isolated Hermes profile sessions

[PhilipJohnBasile]

Supersedes #220 with the app-only implementation requested in review.

This rebuilds the feature from current main and keeps all 14 changed paths under apps/MTPLXApp. It does not change Python engine behavior or add Hermes-specific session-cache policy.

The app now:

• runs isolated Hermes profile sidecars with authenticated /api/ws readiness checks matching Hermes 0.20.5
• verifies the required serve flags before reporting ready
• guards gateway repair across lifecycle teardown
• redacts credential suffixes and credential-bearing URLs while preserving ordinary diagnostics
• disables externally active sessions with a clear fresh-agent path

Validation:

• focused Hermes suite: 145 passed
• full Swift suite: 774 passed, 1 existing skip
• swift build: passed
• app-only scope and git diff --check: passed

@youssofal, please review.