fix(tests): unstick CI — sweep stale tests from recent merges (#12670)

One source fix (web_server category merge) + five test updates that
didn't travel with their feature PRs. All 13 failures on the 04-19
CI run on main are now accounted for (5 already self-healed on main;
8 fixed here).

Changes
- web_server.py: add code_execution → agent to _CATEGORY_MERGE (new
  singleton section from #11971 broke no-single-field-category invariant).
- test_browser_camofox_state: bump hardcoded _config_version 18 → 19
  (also from #11971).
- test_registry: add browser_cdp_tool (#12369) and discord_tool (#4753)
  to the expected built-in tool set.
- test_run_agent::test_tool_call_accumulation: rewrite fragment chunks
  — #0f778f77 switched streaming name-accumulation from += to = to
  fix MiniMax/NIM duplication; the test still encoded the old
  fragment-per-chunk premise.
- test_concurrent_interrupt::_Stub: no-op
  _apply_pending_steer_to_tool_results — #12116 added this call after
  concurrent tool batches; the hand-rolled stub was missing it.
- test_codex_cli_model_picker: drop the two obsolete tests that
  asserted auto-import from ~/.codex/auth.json into the Hermes auth
  store. #12360 explicitly removed that behavior (refresh-token reuse
  races with Codex CLI / VS Code); adoption is now explicit via
  `hermes auth openai-codex`. Remaining 3 tests in the file (normal
  path, Claude Code fallback, negative case) still cover the picker.

Validation
- scripts/run_tests.sh across all 6 affected files + surrounding tests
  (54 tests total) all green locally.

tests/hermes_cli/test_codex_cli_model_picker.py

@@ -1,14 +1,14 @@
-"""Regression test: openai-codex must appear in /model picker when
-credentials are only in the Codex CLI shared file (~/.codex/auth.json)
-and haven't been migrated to the Hermes auth store yet.
+"""Regression tests for the /model picker's credential-discovery paths.
 
-Root cause: list_authenticated_providers() checked the raw Hermes auth
-store but didn't know about the Codex CLI fallback import path.
+Covers:
+ - Normal path (tokens already in Hermes auth store)
+ - Claude Code fallback (tokens only in ~/.claude/.credentials.json)
+ - Negative case (no credentials anywhere)
 
-Fix: _seed_from_singletons() now imports from the Codex CLI when the
-Hermes auth store has no openai-codex tokens, and
-list_authenticated_providers() falls back to load_pool() for OAuth
-providers.
+Note: auto-import from ~/.codex/auth.json was removed in #12360 — Hermes
+now owns its own openai-codex auth state, and users explicitly adopt
+existing Codex CLI tokens via `hermes auth openai-codex`. The old
+"Codex CLI shared file" discovery tests were removed with that change.
 """
 
 import base64
@@ -31,83 +31,6 @@ def _make_fake_jwt(expiry_offset: int = 3600) -> str:
     return f"{header}.{payload}.fakesig"
 
 
-@pytest.fixture()
-def codex_cli_only_env(tmp_path, monkeypatch):
-    """Set up an environment where Codex tokens exist only in ~/.codex/auth.json,
-    NOT in the Hermes auth store."""
-    hermes_home = tmp_path / ".hermes"
-    hermes_home.mkdir()
-    codex_home = tmp_path / ".codex"
-    codex_home.mkdir()
-
-    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
-    monkeypatch.setenv("CODEX_HOME", str(codex_home))
-
-    # Empty Hermes auth store
-    (hermes_home / "auth.json").write_text(
-        json.dumps({"version": 2, "providers": {}})
-    )
-
-    # Valid Codex CLI tokens
-    fake_jwt = _make_fake_jwt()
-    (codex_home / "auth.json").write_text(
-        json.dumps({
-            "tokens": {
-                "access_token": fake_jwt,
-                "refresh_token": "fake-refresh-token",
-            }
-        })
-    )
-
-    # Clear provider env vars so only OAuth is a detection path
-    for var in [
-        "OPENROUTER_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY",
-        "NOUS_API_KEY", "DEEPSEEK_API_KEY", "COPILOT_GITHUB_TOKEN",
-        "GH_TOKEN", "GEMINI_API_KEY",
-    ]:
-        monkeypatch.delenv(var, raising=False)
-
-    return hermes_home
-
-
-def test_codex_cli_tokens_detected_by_model_picker(codex_cli_only_env):
-    """openai-codex should appear when tokens only exist in ~/.codex/auth.json."""
-    from hermes_cli.model_switch import list_authenticated_providers
-
-    providers = list_authenticated_providers(
-        current_provider="openai-codex",
-        max_models=10,
-    )
-    slugs = [p["slug"] for p in providers]
-    assert "openai-codex" in slugs, (
-        f"openai-codex not found in /model picker providers: {slugs}"
-    )
-
-    codex = next(p for p in providers if p["slug"] == "openai-codex")
-    assert codex["is_current"] is True
-    assert codex["total_models"] > 0
-
-
-def test_codex_cli_tokens_migrated_after_detection(codex_cli_only_env):
-    """After the /model picker detects Codex CLI tokens, they should be
-    migrated into the Hermes auth store for subsequent fast lookups."""
-    from hermes_cli.model_switch import list_authenticated_providers
-
-    # First call triggers migration
-    list_authenticated_providers(current_provider="openai-codex")
-
-    # Verify tokens are now in Hermes auth store
-    auth_path = codex_cli_only_env / "auth.json"
-    store = json.loads(auth_path.read_text())
-    providers = store.get("providers", {})
-    assert "openai-codex" in providers, (
-        f"openai-codex not migrated to Hermes auth store: {list(providers.keys())}"
-    )
-    tokens = providers["openai-codex"].get("tokens", {})
-    assert tokens.get("access_token"), "access_token missing after migration"
-    assert tokens.get("refresh_token"), "refresh_token missing after migration"
-
-
 @pytest.fixture()
 def hermes_auth_only_env(tmp_path, monkeypatch):
     """Tokens already in Hermes auth store (no Codex CLI needed)."""