fix(ssl): run CA guard during agent initialization

agent/agent_init.py

@@ -900,6 +900,9 @@ def init_agent(
         agent.api_key = client_kwargs.get("api_key", "")
         agent.base_url = client_kwargs.get("base_url", agent.base_url)
         try:
+            from agent.ssl_guard import verify_ca_bundle_with_fallback
+
+            verify_ca_bundle_with_fallback()
             agent.client = agent._create_openai_client(client_kwargs, reason="agent_init", shared=True)
             if not agent.quiet_mode:
                 print(f"🤖 AI Agent initialized with model: {agent.model}")

docs/rca-ssl-cacert-post-git-pull.md

@@ -1,6 +1,6 @@
 # RCA: SSL CA cert bundle corruption after `hermes update`
 
-**Status:** resolved by `fix(agent,gateway): add SSL CA cert bundle fail-fast guard`  
+**Status:** resolved by `fix(agent,gateway): add SSL CA cert bundle fail-fast guard`
 **Severity:** P2 — degrades the agent into a crash-loop until the user re-installs deps.
 
 ## Summary

gateway/run.py

@@ -29,7 +29,6 @@ import dataclasses
 import inspect
 import json
 import logging
-logger = logging.getLogger(__name__)
 import os
 import re
 import shlex