hermes - 💡(How to fix) Fix Profile Codex auth can ignore global credential pool when local state is stale [1 pull requests]

Bug Description

When Hermes runs under a named profile, Codex runtime credential resolution can report missing credentials even though global Codex auth is valid.

The profile/global auth fallback contract already allows profiles to inherit global-root credentials when the profile does not have usable local credentials. However, the Codex-specific pool fallback path reads only the active profile auth store directly, bypassing the existing read_credential_pool("openai-codex") global fallback behavior.

Steps to Reproduce

1. Authenticate openai-codex globally.
2. Use a named profile whose auth.json contains a stale/empty providers.openai-codex.tokens block and no usable local credential_pool.openai-codex entries.
3. Resolve Codex runtime credentials from that profile.

Expected Behavior

The profile should inherit the global-root credential_pool.openai-codex entry when the profile has no usable local Codex pool entries, matching the existing cross-profile auth fallback contract.

Actual Behavior

Credential resolution fails with a missing access_token/Codex auth error, even though global Codex auth is valid.

Proposed Fix

Update the Codex pool fallback helper to use read_credential_pool("openai-codex") instead of reading only the active profile auth store directly, then add a regression test for stale empty profile singleton state plus valid global Codex pool credentials.

Related fix PR: #34141