simplify(agent-hosts): dedup hermes profile-binding admission check

[devin-ai-integration]

Summary

• Extract the duplicated Hermes profile-binding admission check into one validate_hermes_profile_bindings(host, bindings) helper in host_bundle::control and call it from both enforcement sites.
• Add hermes_profile_binding_admission_is_identical_at_both_entry_points pinning the rule (Hermes: exactly 1 binding; every other host: exactly 0) through both the single-component dry-run and the component-set preview.

Motivation

The same 4-arm match returning HostBundleError::InvalidHermesProfileBinding lived verbatim in planner::plan_lifecycle_mutation and control::validate_component_set_request, differing only in field-access path. One helper makes the security-relevant admission invariant live in a single place so future edits cannot silently diverge.

Changes

• control.rs: new pub(super) fn validate_hermes_profile_bindings; validate_component_set_request calls it in place of the inline match.
• planner.rs: plan_lifecycle_mutation calls the same helper with (manifest.host, request.hermes_profile_bindings) at the same gate position.
• tests.rs: new test covering Hermes × {0,1,2} and a non-Hermes host × {0,1} at both entry points.

Behavior-preserving: identical conditions evaluated, identical error returned at the same point in each validation sequence.

Test plan

• cargo test -p tracedecay-agent-hosts host_bundle::tests — 28 passed
• cargo clippy -p tracedecay-agent-hosts --all-targets -- -D warnings clean
• cargo fmt --all -- --check clean
• python3 scripts/linux-test-partitions.py check clean
• New pinning test: cargo test -p tracedecay-agent-hosts --lib agents::host_bundle::tests::hermes_profile_binding_admission_is_identical_at_both_entry_points -- --exact passes

Checklist

• CHANGELOG.md updated (under [Unreleased] if no version bump)
• No secrets, credentials, or .env files included
• Breaking changes documented (if any) — none

Link to Devin session: https://app.devin.ai/sessions/0d1d5a4296fe4f9ba125199ff3287911
Open in Devin Desktop: https://app.devin.ai/desktop/session/0d1d5a4296fe4f9ba125199ff3287911?variant=devin
Requested by: @ScriptedAlchemy

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: b8577ba

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.