[codex] Add Hermes MCP guard

[RedBeret]

Summary

• add components/hermes/hermes-mcp-guard, an offline scanner for Hermes mcp_servers: config
• flag literal credentials, insecure HTTP endpoints, unallowlisted remote hosts, broad tool exposure, unpinned stdio launchers, and unconstrained sampling
• add installer, component docs, and smoke-test coverage
• include the component in isolated setup testing and public docs

Validation

• bash scripts/smoke-test.sh
• bash scripts/test-components-isolated.sh -> 28 ok, 0 skipped, 0 failed
• bash components/hermes/hermes-mcp-guard/mcp-guard.sh ~/.hermes/config.yaml -> no mcp_servers block found, exit 0
• bash scripts/publish-check.sh -> passed with existing advisory warnings for historical author review and missing local dependency audit tool