fix: enforce config.yaml as sole CWD source + deprecate .env CWD vars + add hermes memory reset (#11029)

config.yaml terminal.cwd is now the single source of truth for working
directory. MESSAGING_CWD and TERMINAL_CWD in .env are deprecated with a
migration warning.

Changes:

1. config.py: Remove MESSAGING_CWD from OPTIONAL_ENV_VARS (setup wizard
   no longer prompts for it). Add warn_deprecated_cwd_env_vars() that
   prints a migration hint when deprecated env vars are detected.

2. gateway/run.py: Replace all MESSAGING_CWD reads with TERMINAL_CWD
   (which is bridged from config.yaml terminal.cwd). MESSAGING_CWD is
   still accepted as a backward-compat fallback with deprecation warning.
   Config bridge skips cwd placeholder values so they don't clobber
   the resolved TERMINAL_CWD.

3. cli.py: Guard against lazy-import clobbering — when cli.py is
   imported lazily during gateway runtime (via delegate_tool), don't
   let load_cli_config() overwrite an already-resolved TERMINAL_CWD
   with os.getcwd() of the service's working directory. (#10817)

4. hermes_cli/main.py: Add 'hermes memory reset' command with
   --target all/memory/user and --yes flags. Profile-scoped via
   HERMES_HOME.

Migration path for users with .env settings:
  Remove MESSAGING_CWD / TERMINAL_CWD from .env
  Add to config.yaml:
    terminal:
      cwd: /your/project/path

Addresses: #10225, #4672, #10817, #7663

tests/hermes_cli/test_deprecated_cwd_warning.py

@@ -0,0 +1,64 @@
+"""Tests for warn_deprecated_cwd_env_vars() migration warning."""
+
+import os
+import pytest
+
+
+class TestDeprecatedCwdWarning:
+    """Warn when MESSAGING_CWD or TERMINAL_CWD is set in .env."""
+
+    def test_messaging_cwd_triggers_warning(self, monkeypatch, capsys):
+        monkeypatch.setenv("MESSAGING_CWD", "/some/path")
+        monkeypatch.delenv("TERMINAL_CWD", raising=False)
+
+        from hermes_cli.config import warn_deprecated_cwd_env_vars
+        warn_deprecated_cwd_env_vars(config={})
+
+        captured = capsys.readouterr()
+        assert "MESSAGING_CWD" in captured.err
+        assert "deprecated" in captured.err.lower()
+        assert "config.yaml" in captured.err
+
+    def test_terminal_cwd_triggers_warning_when_config_placeholder(self, monkeypatch, capsys):
+        monkeypatch.setenv("TERMINAL_CWD", "/project")
+        monkeypatch.delenv("MESSAGING_CWD", raising=False)
+
+        from hermes_cli.config import warn_deprecated_cwd_env_vars
+        # config has placeholder cwd → TERMINAL_CWD likely from .env
+        warn_deprecated_cwd_env_vars(config={"terminal": {"cwd": "."}})
+
+        captured = capsys.readouterr()
+        assert "TERMINAL_CWD" in captured.err
+        assert "deprecated" in captured.err.lower()
+
+    def test_no_warning_when_config_has_explicit_cwd(self, monkeypatch, capsys):
+        monkeypatch.setenv("TERMINAL_CWD", "/project")
+        monkeypatch.delenv("MESSAGING_CWD", raising=False)
+
+        from hermes_cli.config import warn_deprecated_cwd_env_vars
+        # config has explicit cwd → TERMINAL_CWD could be from config bridge
+        warn_deprecated_cwd_env_vars(config={"terminal": {"cwd": "/project"}})
+
+        captured = capsys.readouterr()
+        assert "TERMINAL_CWD" not in captured.err
+
+    def test_no_warning_when_env_clean(self, monkeypatch, capsys):
+        monkeypatch.delenv("MESSAGING_CWD", raising=False)
+        monkeypatch.delenv("TERMINAL_CWD", raising=False)
+
+        from hermes_cli.config import warn_deprecated_cwd_env_vars
+        warn_deprecated_cwd_env_vars(config={})
+
+        captured = capsys.readouterr()
+        assert captured.err == ""
+
+    def test_both_deprecated_vars_warn(self, monkeypatch, capsys):
+        monkeypatch.setenv("MESSAGING_CWD", "/msg/path")
+        monkeypatch.setenv("TERMINAL_CWD", "/term/path")
+
+        from hermes_cli.config import warn_deprecated_cwd_env_vars
+        warn_deprecated_cwd_env_vars(config={})
+
+        captured = capsys.readouterr()
+        assert "MESSAGING_CWD" in captured.err
+        assert "TERMINAL_CWD" in captured.err