What does this PR do?

Fixes .env persistence so stale placeholder secrets like KEY=*** do not survive later writes and override real values.

Today save_env_value() sanitizes the file before writing, but _sanitize_env_lines() only repairs concatenated KEY=VALUE lines. It does not remove placeholder-only secret entries or collapse duplicate keys. That leaves cases like:

OPENAI_API_KEY=new-key
OPENAI_API_KEY=***

In that state, load_env() still resolves the stale trailing value because it keeps the last matching entry.

This change makes _sanitize_env_lines() drop placeholder-only secret lines and keep a single canonical entry per key before writes are persisted.

Related Issue

N/A

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

Changes Made

• Update hermes_cli/config.py so _sanitize_env_lines() removes KEY=*** placeholder secret entries
• Collapse duplicate KEY= entries during sanitization so stale trailing values cannot shadow the current value
• Add a regression test in tests/hermes_cli/test_config.py that reproduces the bug through save_env_value() and load_env()

How to Test

1. Run uv run pytest -q -n 0 tests/hermes_cli/test_config.py
2. Confirm test_save_env_value_removes_stale_placeholder_duplicates passes
3. Confirm the full test file passes

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Focused verification:

uv run pytest -q -n 0 tests/hermes_cli/test_config.py
41 passed, 1 warning in 0.33s