fix(models): repair the two CI slices the default-flip broke

- web_server CONFIG_SCHEMA: fold the one-field models_dev category
  (models_dev.url) into the agent tab via _CATEGORY_MERGE, matching the
  established pattern for single-field categories (slice 7,
  test_no_single_field_categories).
- image_routing._lookup_supports_vision: pass allow_network=True to
  get_model_capabilities. The vision-capability lookup runs when an
  image actually needs routing (not per conversation turn), and the
  #31179 text-only-main guard depends on catalog data — with the new
  allow_network=False default a cold cache returned 'unknown', which
  falls back to attempting the call and reintroduced the #31179
  failure shape (slice 8, test_text_only_main_skipped_when_no_
  aggregator). This preserves that path's historical
  network-on-cold-cache behavior; the fetch stays 4h-TTL cached and
  backoff-limited.

agent/image_routing.py

@@ -432,7 +432,14 @@ def _lookup_supports_vision(
     caps = None
     try:
         from agent.models_dev import get_model_capabilities
-        caps = get_model_capabilities(provider, model)
+        # allow_network=True on purpose: vision-capability lookup runs when
+        # an image actually needs routing (not per turn), and the #31179
+        # text-only-main guard depends on catalog data — a cold cache
+        # returning "unknown" would fall back to attempting the call and
+        # reintroduce the bug. This preserves the historical
+        # network-on-cold-cache behavior for this one path; the fetch is
+        # cached (4h TTL) and backoff-limited after failures.
+        caps = get_model_capabilities(provider, model, allow_network=True)
     except Exception as exc:  # pragma: no cover - defensive
         logger.debug("image_routing: caps lookup failed for %s:%s — %s", provider, model, exc)
     if caps is not None:

hermes_cli/web_server.py

@@ -1038,6 +1038,10 @@ _CATEGORY_MERGE: Dict[str, str] = {
     "skills": "agent",
     "cron": "agent",
     "network": "agent",
+    # `models_dev.url` (mirror override) is the only schema-surfaced
+    # models_dev field — fold it in with the other network/agent plumbing
+    # rather than spawning a one-field orphan tab.
+    "models_dev": "agent",
     "checkpoints": "agent",
     "approvals": "security",
     "human_delay": "display",