Move agent lifecycle UX under obol agent

[bussyjd]

Summary

Stacked on #381 and addresses the CLI UX direction tracked in #384.

• Moves Obol-owned lifecycle/auth/wallet/list/delete/sync/setup/new commands under obol agent.
• Changes obol hermes into native Hermes CLI passthrough, with --agent <id> for non-default Hermes instances and obol-agent as the default target when present.
• Keeps obol openclaw as the manual OpenClaw runtime path while adding obol agent --runtime openclaw management coverage.
• Updates docs, smoke flows, and helper messages away from removed Hermes lifecycle commands.

Validation

• go test ./cmd/obol
• go test ./internal/hermes ./internal/agentruntime
• go test ./internal/stack ./internal/tunnel
• go test ./...
• go build -o .workspace/bin/obol ./cmd/obol
• bash -n flows/flow-04-agent.sh flows/flow-11-dual-stack.sh

[bussyjd]

Testing coverage follow-up from the subagent review is now pushed in ac952d1.

Added:

• Table-driven coverage for resolveAgentTarget and resolveRuntimeInstance, including default Hermes preference, explicit runtime selection, unknown instances, ambiguous IDs across runtimes, and multi-instance errors.
• Table-driven coverage for ResolveCLIInvocation, including --agent=value, -- passthrough, missing/duplicate --agent, unknown agents, no instances, single-instance fallback, and multiple non-default instances.
• Flow 04 smoke step for native Hermes CLI passthrough via obol hermes --agent obol-agent version.

Validation after the update:

• go test ./cmd/obol ./internal/hermes ./internal/agentruntime ./internal/stack ./internal/tunnel
• go test ./...
• go build -o .workspace/bin/obol ./cmd/obol
• bash -n flows/flow-04-agent.sh flows/flow-11-dual-stack.sh

Function coverage for the risky new routing helpers is now high: resolveAgentTarget 90%, resolveRuntimeInstance 92.9%, ResolveCLIInvocation 94.1%, splitCLISelection 87.5%.

[bussyjd]

Rebased onto current main (post-#386 squash merge).

Before: 13 commits on top of main, 21-file conflict — most of those commits (e5fe270…9f8b7ff, the Hermes runtime work) had already landed in main via squash f08651e, but git still saw them as ahead.

After: 2 unique commits remain — Move agent lifecycle UX under obol agent + Add agent CLI resolver coverage. Cherry-picked cleanly with three small conflict resolutions:

• cmd/obol/main.go usage block — kept the new agent {init,new,sync,auth,wallet,list,delete} set AND wallet import (the latter was added in fix(hermes): bookend wallet-import archival with k3d ownership flip #397 / Integrate PR #377 (OBOL Permit2) + PR #381 (Hermes runtime), harden flows, add flow-13 dual-stack OBOL #386 and is a separate top-level command, distinct from agent wallet show/list/backup/restore in agent.go).
• cmd/obol/main.go Commands wiring — kept both agentCommand(cfg) and walletCommand(cfg).
• flows/flow-11-dual-stack.sh — switched bob token obol-agent to bob agent auth obol-agent to match the new shape.

Validation locally: go build ./... clean, go test ./... 24/24 packages pass, 0 failures.