hermes - 💡(How to fix) Fix feat(env): load Nexus vault bootstrap secrets at startup [1 pull requests]

Summary

Load runtime secrets from a Nexus vault bootstrap endpoint during Hermes startup so central vault values can override stale local .env/shell credentials during cutover.

Motivation

Local plaintext .env token loading is fragile for deployed agents. The bootstrap path should allow an integration ID plus Nexus service token to fetch required runtime secrets without hardcoding bot/API tokens in local files.

Acceptance criteria

• load_hermes_dotenv() can opt into Nexus bootstrap loading via explicit env vars.
• Nexus bootstrap secrets override stale local dotenv/shell values.
• Missing bootstrap configuration is a no-op.
• Network/API failures fail closed without leaking secret values.
• Regression tests cover override, skip, and failure cases.