opentui(phase3): launcher integration — HERMES_TUI_ENGINE dual-engine

hermes --tui launches the native OpenTUI engine (Bun) when
HERMES_TUI_ENGINE=opentui (env) or display.tui_engine=opentui (config);
Ink stays the default and the shipping path is untouched.

- _resolve_tui_engine() (env > config > ink); refuses opentui on
  Windows/Termux (no Bun) -> falls back to ink with a notice.
- _make_opentui_argv() -> [bun, src/entry.real.tsx] (no build step).
- _bun_bin() with HERMES_BUN override.
- Branch at top of _make_tui_argv BEFORE _ensure_tui_node (Bun-only host
  must not bootstrap Node).
- Gate _launch_tui NODE_OPTIONS/--max-old-space-size on engine==ink (Bun
  is JSC; the V8 flag errors/ignores).

Verified end-to-end via tmux: real hermes --tui -> Bun -> OpenTUI ->
real Python gateway streamed a real reply. No-flag default still ink.

tests/plugins/test_langfuse_plugin.py

@@ -171,40 +171,6 @@ class TestHooksInert:
         mod.on_post_tool_call(tool_name="read_file", args={}, result="ok", task_id="t", session_id="s")
 
 
-class TestPayloadSanitization:
-    def test_safe_value_redacts_base64_data_uri_instead_of_truncating(self):
-        sys.modules.pop("plugins.observability.langfuse", None)
-        import importlib
-        mod = importlib.import_module("plugins.observability.langfuse")
-
-        payload = "data:image/png;base64," + ("a" * 20000)
-        result = mod._safe_value(payload)
-
-        assert result == {
-            "type": "data_uri",
-            "media_type": "image/png",
-            "omitted": True,
-            "length": len(payload),
-        }
-
-    def test_serialize_messages_redacts_data_uri_parts(self):
-        sys.modules.pop("plugins.observability.langfuse", None)
-        import importlib
-        mod = importlib.import_module("plugins.observability.langfuse")
-
-        payload = "data:image/jpeg;base64," + ("b" * 20000)
-        serialized = mod._serialize_messages([
-            {"role": "user", "content": [{"type": "image_url", "image_url": {"url": payload}}]}
-        ])
-
-        assert serialized[0]["content"][0]["image_url"]["url"] == {
-            "type": "data_uri",
-            "media_type": "image/jpeg",
-            "omitted": True,
-            "length": len(payload),
-        }
-
-
 # ---------------------------------------------------------------------------
 # Placeholder-credential guard (#23823).
 #
@@ -738,76 +704,3 @@ class TestToolObservationKeying:
         assert ended["output"] == {"status": "done"}
         assert not state.tools
 
-
-class TestUsageFromSanitizedResponse:
-    """Regression: ``post_api_request`` delivers ``response`` as a sanitized
-    dict (no ``.usage`` attribute) plus a separate ``usage`` summary dict. The
-    post-call handler must read the ``usage`` dict instead of treating the dict
-    response as a usage-bearing object and dropping all token/cost data."""
-
-    def _setup(self, mod, monkeypatch):
-        # Active client so on_post_llm_call does not early-return.
-        monkeypatch.setattr(mod, "_get_langfuse", lambda: object())
-        observation = object()
-        state = mod.TraceState(trace_id="trace-1", root_ctx=None, root_span=None)
-        state.generations[mod._request_key(1)] = observation
-        monkeypatch.setitem(mod._TRACE_STATE, mod._trace_key("task-1", "session-1"), state)
-        captured = {}
-
-        def fake_end_observation(obs, *, output=None, metadata=None, usage_details=None, cost_details=None):
-            captured["usage_details"] = usage_details
-
-        monkeypatch.setattr(mod, "_end_observation", fake_end_observation)
-        return captured
-
-    def test_sanitized_dict_response_uses_usage_dict(self, monkeypatch):
-        sys.modules.pop("plugins.observability.langfuse", None)
-        mod = importlib.import_module("plugins.observability.langfuse")
-        captured = self._setup(mod, monkeypatch)
-
-        # A plain dict has no ``.usage`` attribute — mirrors post_api_request.
-        mod.on_post_llm_call(
-            task_id="task-1",
-            session_id="session-1",
-            api_call_count=1,
-            model="gemini-3-flash-preview",
-            response={"model": "gemini-3-flash-preview", "usage": {"input_tokens": 100, "output_tokens": 20}},
-            usage={"input_tokens": 100, "output_tokens": 20},
-            assistant_content_chars=42,
-        )
-
-        # Before the fix the dict response shadowed the usage dict and tokens
-        # were lost (usage_details == {}).
-        assert captured["usage_details"] == {"input": 100, "output": 20}
-
-    def test_real_response_object_with_usage_still_used(self, monkeypatch):
-        sys.modules.pop("plugins.observability.langfuse", None)
-        mod = importlib.import_module("plugins.observability.langfuse")
-        captured = self._setup(mod, monkeypatch)
-
-        # A response object that genuinely carries usage must still take the
-        # response-object path (post_llm_call / legacy behavior).
-        seen = {}
-
-        def fake_usage_and_cost(resp, **_):
-            seen["resp"] = resp
-            return {"input": 7, "output": 3}, {}
-
-        monkeypatch.setattr(mod, "_usage_and_cost", fake_usage_and_cost)
-
-        class _Resp:
-            usage = {"prompt_tokens": 7, "completion_tokens": 3}
-
-        resp = _Resp()
-        mod.on_post_llm_call(
-            task_id="task-1",
-            session_id="session-1",
-            api_call_count=1,
-            model="gemini-3-flash-preview",
-            response=resp,
-            usage={"input_tokens": 999, "output_tokens": 999},
-            assistant_content_chars=42,
-        )
-
-        assert seen["resp"] is resp
-        assert captured["usage_details"] == {"input": 7, "output": 3}