mcp-config/hermes: make the gateway's context limits actually reach the clients

Folds in the in-flight local-checkout work and fixes the context accounting
on top of it. Both halves are the same bug seen from two ends: clients were
sending requests larger than the backend's window and getting hard
ContextWindowExceededError 400s, intermittently, in a way that looked like
the model or the GPU misbehaving.

Already in flight here (unchanged in intent):
  - sync.sh prefers the LOCAL CHECKOUT over re-downloading from Gitea, and
    install.sh records the checkout path so it can be found. That recording
    is load-bearing: without it sync.sh cannot find the repo, silently falls
    back to Gitea, and every local edit to opencode.gateway.json is ignored.
    Observed on this box — ~/.config/mcp-sync/source did not exist, the
    default ~/.dotfiles is not where the checkout lives, and the Gitea base
    still served models:{}.
  - the hermes custom-provider wiring.

Fixed on top:

opencode had NO context limit on ANY gateway model, not a wrong one. Two
faults compounded. /model/info 403s for a day-to-day virtual key (only
management-scoped keys may read it), which sync.sh treats as best-effort and
falls back to names-only — as designed and as commented. But the merge then
did `prov["models"] = models`, replacing the map wholesale, so limits
declared in the base config were discarded too and there was no floor left.
Base specs are now a floor that live /model/info overrides field by field:
discovery still wins where present, so this adds no drift, and a 403 no
longer strips the limits. Verified: ornith 195584/32768, the qwens
261120/32768.

hermes' model map named `qwen3-vl-30b-a3b` at 262144 — a model the gateway
stopped serving when Ornith replaced it — while ornith-1.0-35b, the model
actually on cg-1 AND the only one with a window smaller than its neighbours
(196608), had no entry at all and inherited Hermes' default. The one model
needing a lower ceiling was the one not declaring one, which is exactly the
shape that fails only once a session grows.

NOTE for other boxes: hermes reads ~/.hermes/config.yaml, which install.sh
produces by MERGING gateway.yaml. Editing gateway.yaml alone changes nothing
until install.sh re-runs — this machine's live config was patched by hand.

Not addressed here, deliberately: the gateway-side context_window_fallback
(ai-k8s-iac). It is wired but inert while cg-2 is scaled down, so preventing
the oversized request client-side is what actually works today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FoDK4wwB1Twty5gwiriYLf

zsh/zshrc.local.example

@@ -21,24 +21,32 @@
 # (https://llm.covert-gpt.com). Run hermes setup or update config.yaml
 # to set the default model (see ~/.hermes/config.yaml for available models).
 
-# To develop mcp-config/ or skills/ against a working checkout instead of
-# Gitea's main, point the sync at it and source it directly:
-# MCP_SYNC_RAW_URL="file://$HOME/source/dotfiles/mcp-config/opencode.gateway.json"
-# MCP_SYNC_SKILLS_SRC="$HOME/source/dotfiles/skills"
-# . "$HOME/source/dotfiles/mcp-config/sync.sh"
+# mcp-config/install.sh records the checkout it ran from, and the sync reads
+# the config and skills from there — no download, no anonymous read of the repo.
+# To point it at a DIFFERENT checkout (e.g. develop against a feature branch
+# while ~/.dotfiles stays on main), set one variable:
+# MCP_SYNC_REPO="$HOME/source/dotfiles"
+#
+# Only the bootstrap-managed checkout (~/.dotfiles) is ever `git pull`-ed by the
+# hook, and only when clean — a tree you work in is read, never touched.
 
 # --- 1Password CLI -------------------------------------------------------
 # Service-account token for non-interactive `op read` / `op run`.
 # export OP_SERVICE_ACCOUNT_TOKEN=ops_...
 
-# --- Proxmox MCP gateway (ai-k8s-iac) ------------------------------------
-# Credentials for the Proxmox MCP server registered on the covert-gpt
-# LiteLLM gateway. `task up` in ai-k8s-iac reads these env vars and stores
-# them in the inference-mcp Secret; they are never committed.
-# export PROXMOX_MCP_HOST="https://pve.local:8006"
-# export PROXMOX_MCP_TOKEN_ID="root@pam!terragrunt-proxmox"
-# export PROXMOX_MCP_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
-# export PROXMOX_MCP_INSECURE_TLS="true"
+# --- Proxmox -------------------------------------------------------------
+# One pair of credentials, several consumers: the proxmox MCP server
+# (mcp-config/opencode.gateway.json) and the terraform layer in
+# rke2-devops-airgap, whose Taskfile composes PROXMOX_VE_API_TOKEN from them.
+# Unprefixed on purpose — these are Proxmox credentials, not MCP ones.
+#
+# The op-vault loop above already exports them from the `noconnor` item, so
+# these lines are only needed without 1Password. Never committed.
+# export PROXMOX_TOKEN_ID="root@pam!terragrunt-proxmox"
+# export PROXMOX_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
+#
+# The host and TLS setting are hardcoded per-server in the MCP config and read
+# from variables.yaml by terraform, so there is nothing to export for them.
 
 # --- Anything else -------------------------------------------------------
 # Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,