fix(runtime): resolve bare custom provider to loopback or CUSTOM_BASE_URL (salvage #14719)

[teknium1]

Partial salvage of #14719 by @georgex8001 onto current main. Only the runtime_provider.py commit is picked; the ACP/approval contextvar refactor in the same PR is unrelated scope — worth a separate review.

Closes #14676.

What this PR does

Two related bare-custom resolution fixes:

1. Consult CUSTOM_BASE_URL env var in runtime resolution (not just model-list display). Before, setting only CUSTOM_BASE_URL with bare provider: custom fell through to OpenRouter.
2. Protect against stale YAML state hijacking a Custom session. When /model switches to Custom while model.provider in YAML still reflects a prior cloud provider (OpenRouter, Z.AI, etc.), model.base_url is only trusted if it's a loopback host (localhost, 127.0.0.1, ::1, 0.0.0.0) OR the YAML provider is already custom.

How

• New _loopback_hostname() + _config_base_url_trustworthy_for_bare_custom() helpers in hermes_cli/runtime_provider.py
• _resolve_openrouter_runtime now reads CUSTOM_BASE_URL ahead of the OpenRouter default URLs
• use_config_base_url gate for bare custom runs through the loopback-trust check

Cherry-pick scope

PR #14719 bundled two unrelated fixes: (a) this runtime fix, (b) an ACP approval thread-safety refactor via contextvars. Only (a) is salvaged here; (b) lives in commit d9ef7a72 on the original PR — it can be evaluated separately.

Changes

• @georgex8001 (fix(runtime): resolve bare custom provider to loopback or CUSTOM_BASE_URL (#14676) #14719 commit 1): +28/-1 in runtime_provider.py, 66 lines of regression tests
• Follow-up: AUTHOR_MAP entry for georgex8001@gmail.com

Validation

Scenario	Before	After
Loopback YAML + stale provider: openrouter, select custom	hijacked → openrouter.ai	trusted → localhost:8082
Non-loopback YAML + stale provider: openrouter, select custom	trusted, hijacked session	falls back to OpenRouter (correct)
CUSTOM_BASE_URL=http://localhost:9090/v1, no model.base_url	ignored → openrouter.ai	honored → localhost:9090
Explicit provider: custom + loopback base_url	worked	still works (regression guard)

• tests/hermes_cli/test_runtime_provider_resolution.py — 74/74 pass (3 new regression tests)
• E2E: all 4 scenarios above verified with real module imports

Co-authored-by: @georgex8001