hermes-stack: four governance layers for Hermes Agent in 200 lines

A new Python wrapper, hermes-stack, adds governance around Hermes Agent without changing its core call flow.

It enforces budget and call-count caps, outbound host allowlisting, JSONL audit logging, and schema-checked structured outputs.

The harness can run offline with a stub or against OpenRouter, and the trace shows the order of checks and failures.

The approach helps prevent runaway spend, unauthorized network access, and malformed agent outputs by failing closed.