fix: extend hostname-match provider detection across remaining call sites

Aslaaen's fix in the original PR covered _detect_api_mode_for_url and the
two openai/xai sites in run_agent.py. This finishes the sweep: the same
substring-match false-positive class (e.g. https://api.openai.com.evil/v1,
https://proxy/api.openai.com/v1, https://api.anthropic.com.example/v1)
existed in eight more call sites, and the hostname helper was duplicated
in two modules.

- utils: add shared base_url_hostname() (single source of truth).
- hermes_cli/runtime_provider, run_agent: drop local duplicates, import
  from utils. Reuse the cached AIAgent._base_url_hostname attribute
  everywhere it's already populated.
- agent/auxiliary_client: switch codex-wrap auto-detect, max_completion_tokens
  gate (auxiliary_max_tokens_param), and custom-endpoint max_tokens kwarg
  selection to hostname equality.
- run_agent: native-anthropic check in the Claude-style model branch
  and in the AIAgent init provider-auto-detect branch.
- agent/model_metadata: Anthropic /v1/models context-length lookup.
- hermes_cli/providers.determine_api_mode: anthropic / openai URL
  heuristics for custom/unknown providers (the /anthropic path-suffix
  convention for third-party gateways is preserved).
- tools/delegate_tool: anthropic detection for delegated subagent
  runtimes.
- hermes_cli/setup, hermes_cli/tools_config: setup-wizard vision-endpoint
  native-OpenAI detection (paired with deduping the repeated check into
  a single is_native_openai boolean per branch).

Tests:
- tests/test_base_url_hostname.py covers the helper directly
  (path-containing-host, host-suffix, trailing dot, port, case).
- tests/hermes_cli/test_determine_api_mode_hostname.py adds the same
  regression class for determine_api_mode, plus a test that the
  /anthropic third-party gateway convention still wins.

Also: add asslaenn5@gmail.com → Aslaaen to scripts/release.py AUTHOR_MAP.

tests/test_base_url_hostname.py

@@ -0,0 +1,55 @@
+"""Targeted tests for ``utils.base_url_hostname``.
+
+The helper is used across provider routing, auxiliary client, and setup
+wizards to avoid the substring-match false-positive class documented in
+tests/agent/test_direct_provider_url_detection.py.
+"""
+
+from __future__ import annotations
+
+from utils import base_url_hostname
+
+
+def test_empty_returns_empty_string():
+    assert base_url_hostname("") == ""
+    assert base_url_hostname(None) == ""  # type: ignore[arg-type]
+
+
+def test_plain_host_without_scheme():
+    assert base_url_hostname("api.openai.com") == "api.openai.com"
+    assert base_url_hostname("api.openai.com/v1") == "api.openai.com"
+
+
+def test_https_url_extracts_hostname_only():
+    assert base_url_hostname("https://api.openai.com/v1") == "api.openai.com"
+    assert base_url_hostname("https://api.x.ai/v1") == "api.x.ai"
+    assert base_url_hostname("https://api.anthropic.com") == "api.anthropic.com"
+
+
+def test_hostname_case_insensitive():
+    assert base_url_hostname("https://API.OpenAI.com/v1") == "api.openai.com"
+
+
+def test_trailing_dot_stripped():
+    # Fully-qualified hostnames may include a trailing dot.
+    assert base_url_hostname("https://api.openai.com./v1") == "api.openai.com"
+
+
+def test_path_containing_provider_host_is_not_the_hostname():
+    # The key regression — proxy paths must never be misread as the host.
+    assert base_url_hostname("https://proxy.example.test/api.openai.com/v1") == "proxy.example.test"
+    assert base_url_hostname("https://proxy.example.test/api.anthropic.com/v1") == "proxy.example.test"
+
+
+def test_host_suffix_is_not_the_provider():
+    # A hostname that merely ends with the provider domain is not the provider.
+    assert base_url_hostname("https://api.openai.com.example/v1") == "api.openai.com.example"
+    assert base_url_hostname("https://api.x.ai.example/v1") == "api.x.ai.example"
+
+
+def test_port_is_ignored():
+    assert base_url_hostname("https://api.openai.com:443/v1") == "api.openai.com"
+
+
+def test_whitespace_stripped():
+    assert base_url_hostname("  https://api.openai.com/v1  ") == "api.openai.com"