hermes - 💡(How to fix) Fix Profiled workers need a shared auth home separate from isolated HERMES_HOME [1 pull requests]

Bug

Profiled Hermes workers can end up with split-brain OAuth/auth state when runtime profile state and long-lived OAuth credentials are both derived from isolated HERMES_HOME locations.

This is especially risky for OAuth providers with rotating or single-use refresh tokens: multiple profiled workers may read/write different auth.json files instead of coordinating through one credential store and one lock.

Reproduction

1. Run multiple Hermes profiles/workers with isolated HERMES_HOME values.
2. Use OAuth-backed providers whose refresh tokens rotate or are single-use.
3. Workers read/write separate auth stores, causing credential drift or refresh failures.

Expected

Hermes should allow isolated profile/runtime state while sharing one explicit auth-store root for long-lived OAuth credentials.

Proposed fix

Introduce an explicit auth-store root, e.g. HERMES_AUTH_HOME, separate from HERMES_HOME, and avoid falling back to a read-only global auth store when an explicit shared auth home is configured.

Relevant files from the closed PR draft:

• hermes_cli/auth.py
• tests/hermes_cli/test_auth_profile_fallback.py

Originally proposed as PR #29502, now converted to an issue to avoid maintaining a contributor fork.