fix(tools): don't report platform-restricted toolsets as enabled

tools_disable_enable_command filters platform-restricted toolsets out of
toolset_targets and prints an error for each, but the success summary at
the end is built from the raw targets list and only excludes unknown
toolsets and failed MCP servers. Running e.g.

    hermes tools enable discord --platform telegram

prints the 'not available on platform' error followed by 'Enabled:
discord' for a toolset that was never written to the config.

Exclude restricted_targets from the success summary, matching how
unknown toolsets and failed MCP servers are already handled.

Two regression tests: a restricted toolset alone must not print
'Enabled', and a mixed allowed+restricted invocation must report only
the allowed toolset (both fail before the fix).

hermes_cli/tools_config.py

@@ -4524,7 +4524,9 @@ def tools_disable_enable_command(args):
 
     successful = [
         t for t in targets
-        if t not in unknown_toolsets and (":" not in t or t.split(":")[0] not in failed_servers)
+        if t not in unknown_toolsets
+        and t not in restricted_targets
+        and (":" not in t or t.split(":")[0] not in failed_servers)
     ]
     if successful:
         verb = "Disabled" if action == "disable" else "Enabled"

tests/hermes_cli/test_tools_disable_enable.py

@@ -212,6 +212,31 @@ class TestToolsValidation:
         assert "web" in saved["platform_toolsets"]["cli"]
         assert "memory" in saved["platform_toolsets"]["cli"]
 
+    def test_restricted_toolset_not_reported_as_enabled(self, capsys):
+        config = {"platform_toolsets": {"telegram": ["web"]}}
+        with patch("hermes_cli.tools_config.load_config", return_value=config), \
+             patch("hermes_cli.tools_config.save_config"):
+            tools_disable_enable_command(
+                Namespace(tools_action="enable", names=["discord"], platform="telegram")
+            )
+        out = capsys.readouterr().out
+        assert "not available on platform 'telegram'" in out
+        assert "Enabled" not in out
+
+    def test_mixed_allowed_and_restricted_reports_allowed_only(self, capsys):
+        config = {"platform_toolsets": {"telegram": []}}
+        with patch("hermes_cli.tools_config.load_config", return_value=config), \
+             patch("hermes_cli.tools_config.save_config") as mock_save:
+            tools_disable_enable_command(
+                Namespace(tools_action="enable", names=["web", "discord"], platform="telegram")
+            )
+        out = capsys.readouterr().out
+        assert "Enabled: web" in out
+        assert "discord" not in out.split("Enabled:")[-1]
+        saved = mock_save.call_args[0][0]
+        assert "web" in saved["platform_toolsets"]["telegram"]
+        assert "discord" not in saved["platform_toolsets"]["telegram"]
+
     def test_mixed_valid_and_invalid_applies_valid_only(self):
         config = {"platform_toolsets": {"cli": ["web", "memory"]}}
         with patch("hermes_cli.tools_config.load_config", return_value=config), \