docs: sync overnight sweep with registry, gateway, curator, cron
Salvaged from #72422 by @virtuadex (conflicts resolved against current
main; superseded slash-command hunks dropped):
- SECURITY.md + SECURITY.es.md: gateway adapters live under
plugins/platforms/<name>/, registry in gateway/platform_registry.py
- gateway-internals.md (EN + zh-Hans): key-files table rows for
platform_registry.py and plugins/platforms/, deferred-loading section
- slash-commands.md: /reasoning full level list (max/ultra) + --global;
CLI-only notes list gains /prompt, /pet, /hatch, /timestamps
- cron.md + cron-script-only.md: script runner accuracy — bash resolved
from PATH with /bin/bash fallback, script paths confined to
~/.hermes/scripts/, provider credentials stripped via
_sanitize_subprocess_env
- curator.md: cron-referenced skills protected from auto-archive,
never-used grace floor
782d0219a0