[codex] Add Hermes hook audit logger

[RedBeret]

Summary

• add components/hermes/hermes-hook-audit, an observational shell hook that writes redacted JSONL audit records
• log event metadata, tool name, session ID, cwd, payload size, redacted preview, and command SHA-256
• add installer, component docs, and smoke coverage proving fake secrets are redacted
• include the component in isolated setup testing and public docs

Validation

• bash scripts/smoke-test.sh
• bash scripts/test-components-isolated.sh -> 29 ok, 0 skipped, 0 failed
• bash scripts/publish-check.sh -> passed with existing advisory warnings for historical author review and missing local dependency audit tool