fix(hermes): allow two direct CLI lane workers

services/hermes/execution-coordinator-patch.yaml

@@ -18,7 +18,9 @@ spec:
         - name: cli-lane-runner
           env:
             - {name: HERMES_CLI_LANE_OWNED_WORKSPACES_ONLY, value: "true"}
-            - {name: HERMES_CLI_LANE_CONCURRENCY, value: "1"}
+            # Cap simultaneous direct cli-* Codex/Claude runner slots separately
+            # from the normal Hermes profile cap in agent-configmap.yaml.
+            - {name: HERMES_CLI_LANE_CONCURRENCY, value: "2"}
         - name: execution-pool-coordinator
           image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107
           imagePullPolicy: IfNotPresent

testing/tests/test_hermes_execution_pool_assignment.py

@@ -124,7 +124,7 @@ def test_additive_patch_replaces_local_lane_without_touching_base_deployment():
     environment = {item["name"]: item["value"] for item in local["env"]}
     assert environment == {
         "HERMES_CLI_LANE_OWNED_WORKSPACES_ONLY": "true",
-        "HERMES_CLI_LANE_CONCURRENCY": "1",
+        "HERMES_CLI_LANE_CONCURRENCY": "2",
     }
     assert pool["resources"]["requests"] == {"cpu": "50m", "memory": "128Mi"}
     access = next(item for item in pool["volumeMounts"] if item["name"] == "runtime-access")