mcp-config/hermes: make the gateway's context limits actually reach the clients

Folds in the in-flight local-checkout work and fixes the context accounting
on top of it. Both halves are the same bug seen from two ends: clients were
sending requests larger than the backend's window and getting hard
ContextWindowExceededError 400s, intermittently, in a way that looked like
the model or the GPU misbehaving.

Already in flight here (unchanged in intent):
  - sync.sh prefers the LOCAL CHECKOUT over re-downloading from Gitea, and
    install.sh records the checkout path so it can be found. That recording
    is load-bearing: without it sync.sh cannot find the repo, silently falls
    back to Gitea, and every local edit to opencode.gateway.json is ignored.
    Observed on this box — ~/.config/mcp-sync/source did not exist, the
    default ~/.dotfiles is not where the checkout lives, and the Gitea base
    still served models:{}.
  - the hermes custom-provider wiring.

Fixed on top:

opencode had NO context limit on ANY gateway model, not a wrong one. Two
faults compounded. /model/info 403s for a day-to-day virtual key (only
management-scoped keys may read it), which sync.sh treats as best-effort and
falls back to names-only — as designed and as commented. But the merge then
did `prov["models"] = models`, replacing the map wholesale, so limits
declared in the base config were discarded too and there was no floor left.
Base specs are now a floor that live /model/info overrides field by field:
discovery still wins where present, so this adds no drift, and a 403 no
longer strips the limits. Verified: ornith 195584/32768, the qwens
261120/32768.

hermes' model map named `qwen3-vl-30b-a3b` at 262144 — a model the gateway
stopped serving when Ornith replaced it — while ornith-1.0-35b, the model
actually on cg-1 AND the only one with a window smaller than its neighbours
(196608), had no entry at all and inherited Hermes' default. The one model
needing a lower ceiling was the one not declaring one, which is exactly the
shape that fails only once a session grows.

NOTE for other boxes: hermes reads ~/.hermes/config.yaml, which install.sh
produces by MERGING gateway.yaml. Editing gateway.yaml alone changes nothing
until install.sh re-runs — this machine's live config was patched by hand.

Not addressed here, deliberately: the gateway-side context_window_fallback
(ai-k8s-iac). It is wired but inert while cg-2 is scaled down, so preventing
the oversized request client-side is what actually works today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FoDK4wwB1Twty5gwiriYLf

hermes/gateway.yaml

@@ -45,10 +45,26 @@ custom_providers:
       # context remains. Do NOT add model.max_tokens to work around anything: it
       # is GLOBAL, would apply to every provider (including Anthropic), and only
       # shrinks the effective input budget Hermes compacts against.
-      qwen3-vl-30b-a3b: # cg-1 — multimodal, tool calling
-        context_length: 262144
+      # CORRECTED 2026-09-11. This map had drifted badly and the drift was
+      # not visible from inside Hermes: it listed `qwen3-vl-30b-a3b` at
+      # 262144, a model the gateway stopped serving when Ornith replaced it,
+      # while Ornith — the model actually on cg-1, and a SMALLER window at
+      # 196608 — had no entry at all. A model with no entry gets whatever
+      # default Hermes carries, so the one model on this gateway that needs a
+      # lower ceiling than its neighbours was the one model not declaring one.
+      # That is the right shape to produce exactly the reported symptom: fine
+      # on short turns, hard 400 once a task grows.
+      ornith-1.0-35b: # cg-1 — reasoning + tool calling, multimodal
+        # 196608, NOT 262144. Lower than the others on purpose — see
+        # vllm.nodes[cg1] --max-model-len.
+        context_length: 196608
         supports_vision: true
+      qwen3.8-27b: # cg-2 — general, NVFP4
+        context_length: 262144
       qwen3-coder-next: # cg-2 — agentic coder
+        # Shares cg-2 with qwen3.8-27b; only one is enabled at a time, so at
+        # most one of these two is ever live. Both are listed because which
+        # one it is changes without touching this file.
         context_length: 262144
       # Models the gateway proxies to third parties (kimi, glm, …) are
       # intentionally absent: discovery still lists them, and inventing a