feat: expose HERMES_SESSION_ID to agent tools via ContextVar + env (#23847)

Set HERMES_SESSION_ID using the existing session_context.py ContextVar
system for concurrency safety (multiple gateway sessions in one process
won't cross-talk). Also writes os.environ as fallback for CLI mode.

Touchpoints:
- gateway/session_context.py: Add _SESSION_ID ContextVar + _VAR_MAP entry
- run_agent.py: Set both ContextVar and os.environ at init and on
  context-compression rotation
- tools/environments/local.py: Bridge ContextVars into subprocess env
  in _make_run_env() (ContextVars don't propagate to child processes)
- tests/run_agent/test_session_id_env.py: 3 tests covering env, provided
  ID, and ContextVar paths

execute_code subprocess already passes HERMES_* prefixed vars through
_scrub_child_env (line 82: _SAFE_ENV_PREFIXES includes 'HERMES_').

Primary use case: webhook-triggered agents that need to include a
`--resume <session_id>` takeover command in their output.

tests/run_agent/test_session_id_env.py

@@ -0,0 +1,61 @@
+"""Test that HERMES_SESSION_ID is exposed as an env var and ContextVar."""
+
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "../.."))
+
+from run_agent import AIAgent
+
+
+@pytest.fixture(autouse=True)
+def _cleanup_env():
+    """Remove HERMES_SESSION_ID before/after each test."""
+    os.environ.pop("HERMES_SESSION_ID", None)
+    yield
+    os.environ.pop("HERMES_SESSION_ID", None)
+
+
+def test_session_id_env_set_on_init():
+    """AIAgent.__init__ sets HERMES_SESSION_ID in the environment."""
+    agent = AIAgent(
+        api_key="test-key",
+        base_url="https://openrouter.ai/api/v1",
+        quiet_mode=True,
+        skip_context_files=True,
+        skip_memory=True,
+    )
+    assert os.environ.get("HERMES_SESSION_ID") == agent.session_id
+    assert len(agent.session_id) > 0
+
+
+def test_session_id_env_uses_provided_id():
+    """When session_id is passed explicitly, HERMES_SESSION_ID reflects it."""
+    custom_id = "20260511_120000_abc12345"
+    agent = AIAgent(
+        api_key="test-key",
+        base_url="https://openrouter.ai/api/v1",
+        session_id=custom_id,
+        quiet_mode=True,
+        skip_context_files=True,
+        skip_memory=True,
+    )
+    assert os.environ["HERMES_SESSION_ID"] == custom_id
+    assert agent.session_id == custom_id
+
+
+def test_session_id_contextvar_set():
+    """AIAgent.__init__ also sets the ContextVar for concurrency safety."""
+    custom_id = "20260511_130000_def67890"
+    AIAgent(
+        api_key="test-key",
+        base_url="https://openrouter.ai/api/v1",
+        session_id=custom_id,
+        quiet_mode=True,
+        skip_context_files=True,
+        skip_memory=True,
+    )
+    from gateway.session_context import get_session_env
+    assert get_session_env("HERMES_SESSION_ID") == custom_id