fix(hermes): defer sanitizer patch out of plugin discovery lock

[prismatic7]

Problem

First launch of the Hermes TUI over an interactive SSH session stalls: the UI renders but nothing responds. Ctrl+C and relaunch works. This is an ABBA deadlock between two threads at TUI startup:

• Discovery thread (tui-mcp-discovery): holds _discovery_lock (in Hermes' hermes_cli/plugins.py) → loads plugins → contextpilot.register() → _patch_hermes_sanitizer() → import run_agent → blocks on the Python import lock
• Agent build thread (_build): holds the import lock (importing run_agent) → module-level model_tools.discover_plugins() → blocks on _discovery_lock

Each thread holds one lock and waits on the other → deadlock → the TUI's run_after_agent_ready waits forever on ready.wait().

Fix

Remove the eager _patch_hermes_sanitizer() call from register(). The patch is already applied safely in ContextPilotEngine.on_session_start() (line 706), which Hermes invokes at agent init — after the agent is built, so run_agent is already imported and there is no lock contention. The eager call in register() is redundant and is the only path that imports run_agent while the discovery lock is held.

Verification

• register() no longer imports run_agent; the patch still installs on the first session start.
• Syntax-checked; no other eager _patch_hermes_sanitizer() call sites remain.
• Reproduced the stall on Hermes TUI (first launch over SSH), confirmed the deadlock via thread dump, and confirmed this is the only plugin importing run_agent during discovery.