fix(gateway): translate inbound document host paths to container paths for Docker backend

[ambition0802]

When terminal.backend is docker, inbound documents uploaded via messaging
platforms (Telegram, Slack, Discord, Feishu, Email, etc.) are cached at a host
path under ~/.hermes/cache/documents, but the container sandbox only sees them
at the auto-mounted /root/.hermes/cache/documents path.

This PR adds to_agent_visible_cache_path() in tools/credential_files.py (the
natural sibling to get_cache_directory_mounts()) and calls it at the
document-context-injection site in gateway/run.py so the agent always receives
a path it can open directly, matching the mount layout already established
by get_cache_directory_mounts() (#4846).

Scope: only Docker backend for now; other backends use different mount
semantics and are left unchanged until verified.

Fixes #18787

[alt-glitch]

Competing with #18794 which also fixes #18787 (same path translation for Docker backend).

[alt-glitch]

Competing with #18794 which also fixes #18787.

[pvdb2178]

Hey @ambition0802 — I'm the reporter of #18787. I went ahead and opened #19610 with the same fix not realising your PR was already in flight (apologies, that's on me — I only checked merged PRs). I've closed mine.

Two pieces from my branch that might be useful for this PR if you want them:

1. 9 unit tests in tests/tools/test_credential_files.py::TestToAgentVisibleCachePath covering: each cache subdir, nested subpaths, non-docker pass-through, paths outside the cache, idempotence on already-translated paths, case/space-insensitive backend, custom container_base, and empty input.
2. One-line docs note in website/docs/user-guide/docker.md (Skills and credential files section) explaining the cache bind-mount + path rewrite, where the related skills/credential mount behavior is already documented.

Happy to push them as a fixup commit to your branch if you grant collaborator access on ambition0802/hermes-agent:<your-branch>, or you can cherry-pick the relevant hunks from pvdb2178/hermes-agent:fix/inbound-doc-path-translation (commit 6d1b61d). Either is fine — your call. Or skip them entirely if you'd prefer to keep the PR minimal; the maintainer may just want the core fix.

For the test set specifically I think it's worth landing alongside the fix since it locks in the contract for any future backend extensions.