feat(cli): aggregate Hermes profiles in scheduled sync

[kvnloo]

Problem

Scheduled sync captures HERMES_HOME only when users set it explicitly. Hermes Agent isolates named profiles under .hermes/profiles/<name>/state.db, so the service installed by tokenmaxxing can miss profile usage even though ccusage supports multiple comma-separated Hermes roots. This extends the Hermes support merged in #65; it does not replace or duplicate that integration.

Approach

• Discover the default Hermes root and profile directories with readable state.db files when HERMES_HOME is absent.
• Preserve any explicit non-empty HERMES_HOME unchanged.
• Use canonical paths, deterministic code-unit ordering, and deduplication.
• Constrain canonical candidates and their state databases to the user's Hermes root; ignore symlink escapes, unreadable entries, and comma-containing paths that cannot be represented safely in ccusage's delimiter contract.
• Apply the same discovery to initial service install and deferred/service repair, degrading filesystem discovery failures to the unchanged environment so other usage sources keep syncing.

Tests

• Added POSIX and Windows path-semantics coverage for root-only and multi-profile discovery, explicit overrides, ordering, deduplication, mixed-case Windows containment, unreadable state, symlink escapes, comma paths, and empty discovery.
• Added integration coverage proving both service install and deferred repair render discovered roots into the wrapper.
• bun test apps/cli/src/commands/service.test.ts (90 passed)
• bun run test (all workspace suites passed; CLI 254 tests)
• bun run typecheck
• bun run lint (passes with one unrelated existing warning)
• bun run fmt
• bun run build

Security and compatibility

Discovery never scans outside the canonical per-user Hermes root and fails closed for escaped or unrepresentable paths. Existing explicit configuration keeps precedence. No API, server schema, or ccusage wire changes are required. Filesystem discovery failures do not block non-Hermes scheduled sync.

Scope

This PR changes only CLI service environment discovery and its tests.

[kvnloo]

Maintainer-ready evidence for exact head 79b66321ad4b61c3804f814434270858f8cebf7b: the two-file scheduled-sync change was independently reviewed after its Windows containment, deterministic ordering, comma-path fail-closed, install-wrapper, and deferred-repair contracts were tightened. Focused CLI tests passed 90/90; full workspace tests, typecheck, lint, format, and diff-check passed. The PR is currently open, non-draft, mergeable, and clean with no technical blocker found.