`hermes --version` only proves the venv and entry point execute; it says
nothing about whether a chat turn actually completes end to end (config
loading, provider resolution, the model-call path, tool loop, response
rendering).
Add require_hermes_chat_round_trip(), which inside the same sandbox
invocation: starts the shared mock inference server
(scripts/mock-inference-server.mjs, already available via the tarred-in
repo checkout at /work/repo -- no extra fixture plumbing needed), points
a generated config.yaml/.env at it, and runs `hermes -z "hi"`, asserting
the mock's canned reply comes back. Runs after both the initial install
and each update route (hermes update / installer re-run).
`-z`/`--oneshot` is a comparatively recent CLI surface, so probe the
installed binary's --help before relying on it (oneshot_supported()),
same pattern as the existing update_supports()/installer_supports()
probes -- older sampled releases skip the round-trip with a stated
reason instead of failing.
The sandbox's stage2-run.sh forces HTTP_PROXY/HTTPS_PROXY at everything
so install.sh's real network calls ride the fake-internet proxy; the
inner script explicitly unsets them and sets NO_PROXY for localhost so
the plain HTTP call to our own mock server doesn't get routed into
proxy.py, which was never built to relay it.
d96a7f98a8