hermes: wire quota-aware lane routing config and metrics scrape

Add kanban routing keys (provider_quota_min_remaining_percent: 15,
provider_capacity_cooldown_seconds: 300, provider_auth_cooldown_seconds:
3600), a lane-metrics port/Service on 9011 with service-annotation
scraping, monitoring ingress for the new port, and the lane's quota
metrics URL env. Based on PR #15 (fix/hermes-result-decomposition-
reliability); stacked because this work rides on the decomposed lane.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/hermes/agent-configmap.yaml

@@ -88,6 +88,14 @@ data:
       auto_decompose: true
       auto_decompose_per_tick: 2
       dispatch_stale_timeout_seconds: 14400
+      # Steady-state quota-aware routing for the direct CLI lane: below this
+      # remaining-percent a provider stops receiving NEW cli-auto work while
+      # active work finishes; lane-observed capacity/auth failures exclude a
+      # provider until the cooldown elapses, its quota window resets, or a
+      # fresh success is recorded.
+      provider_quota_min_remaining_percent: 15
+      provider_capacity_cooldown_seconds: 300
+      provider_auth_cooldown_seconds: 3600
 
     model_catalog:
       enabled: true

services/hermes/agent-deployment.yaml

@@ -25,7 +25,7 @@ spec:
         ai.bstein.dev/execution: Hermes Kanban with durable direct Codex and Claude Code CLI workers
         ai.bstein.dev/model-policy: Jetson-assisted AUTO routing, low through xhigh, cross-provider fallback
         ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
-        ai.bstein.dev/config-rev: "20260816-auth-health-quarantine-v6"
+        ai.bstein.dev/config-rev: "20260817-cli-auto-quota-routing-v1"
         prometheus.io/scrape: "true"
         prometheus.io/path: /metrics
         prometheus.io/port: "9010"
@@ -866,6 +866,8 @@ spec:
               . /opt/data/.env
               set +a
               exec /opt/hermes/.venv/bin/python /opt/coordinator/cli_lane_runner.py
+          ports:
+            - {name: lane-metrics, containerPort: 9011, protocol: TCP}
           env:
             - {name: HERMES_HOME, value: /opt/data}
             - {name: HERMES_AUTH_FILE, value: /runtime-access/hermes-auth.json}
@@ -876,6 +878,8 @@ spec:
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_CLI_LANE_CONCURRENCY, value: "2"}
             - {name: HERMES_CLI_HEALTH_MAX_AGE_SECONDS, value: "60"}
+            - {name: HERMES_CLI_LANE_METRICS_PORT, value: "9011"}
+            - {name: HERMES_CLI_QUOTA_METRICS_URL, value: "http://127.0.0.1:9010/metrics"}
             - {name: HERMES_AUTO_ROUTER_PROFILE, value: agent}
             - {name: PATH, value: /opt/coordinator:/opt/data/tools/bin:/opt/data/home/.local/bin:/opt/hermes/.venv/bin:/usr/local/bin:/usr/bin:/bin}
           securityContext:

services/hermes/networkpolicy.yaml

@@ -119,6 +119,7 @@ spec:
               app: server
       ports:
         - {protocol: TCP, port: 9010}
+        - {protocol: TCP, port: 9011}
   # agent.hermes.bstein.dev is an owner-only engineering workstation. The
   # browser boundary remains OAuth-protected, while its workers need to reach
   # every cluster namespace, Atlas LAN service, and hosted provider endpoint.

services/hermes/service.yaml

@@ -150,3 +150,24 @@ spec:
       port: 9006
       targetPort: claude-broker
       protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hermes-cli-lane-metrics
+  namespace: hermes
+  labels:
+    app: hermes-agent
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9011"
+    prometheus.io/path: /metrics
+spec:
+  type: ClusterIP
+  selector:
+    app: hermes-agent
+  ports:
+    - name: lane-metrics
+      port: 9011
+      targetPort: lane-metrics
+      protocol: TCP