fix(nh3-dev): strip the Hermes api_server tool surface; flag the z.ai model resolution

Set platform_toolsets[api_server] = [] in ~/.hermes/config.yaml. Measured
back on /v1/toolsets: 28 rows before and after, enabled 14 -> 0, registered
tools 40 -> 0. The row count surviving matters — SVOS's _hermes_roster
derives its required-config line from the full report, so narrowing the
surface does not blind the diagnostic. terminal, code_execution, file,
browser and computer_use are now unregistered rather than merely
unreachable.

Separately, record an unresolved finding raised by svos-dev: model.default
names anthropic/claude-opus-4.6 and model.base_url names openrouter, but
provider: auto with only a zai credential resolves Miranda to GLM-5.3 on
the paid z.ai Coding Plan. Nothing under ~/.hermes references the LiteLLM
gateway. The operator believes Miranda runs on gen-large, which does exist
on LiteLLM. Not repointed — the premise is his to confirm.

servers/nh3-dev/README.md

@@ -27,11 +27,24 @@ local Bash already executes here — no SSH-to-self needed for non-privileged wo
   **SVOS/Miranda**, which replaced Worldtree with Hermes on 2026-09-11 and
   cannot boot without it. Bearer auth is mandatory even on loopback — key
   vaulted as `nh3-dev/hermes/api-server-key`. ⚠ The gateway registers Hermes's
-  **full** toolset by default (28 toolsets incl. `terminal`, `code_execution`,
-  `file`, `browser`); SVOS's security model is to strip all of them via
-  `platform_toolsets[api_server]` + `agent.disabled_toolsets` once its
-  `svos_miranda` plugin lands in `$HERMES_HOME/plugins/`. Until then the surface
-  is wide — loopback bind + key are the only containment.
+  **full** toolset by default — 28 toolsets, 14 enabled, `terminal` /
+  `code_execution` / `file` / `browser` among them. SVOS's security model is that
+  write-capable tools are never *registered*, not that they are refused at
+  dispatch, so `platform_toolsets: {api_server: []}` is set in `config.yaml`
+  (2026-09-14) and measured back as 28 rows / **0 enabled / 0 tools** on
+  `/v1/toolsets`. The endpoint still reports all 28 rows with their flags, which
+  is what SVOS's `_hermes_roster` derives its required-config line from —
+  narrowing does not blind it. Becomes `[svos_miranda]` once SVOS's plugin lands
+  in `$HERMES_HOME/plugins/`.
+- ⚠ **Hermes model resolution is NOT the free local gateway.** `model.default`
+  says `anthropic/claude-opus-4.6` and `model.base_url` says openrouter, but
+  `provider: auto` plus a lone `zai` credential in `auth.json` resolves Miranda
+  to **GLM-5.3 over the paid z.ai Coding Plan**
+  (`https://api.z.ai/api/coding/paas/v4`). Nothing under `~/.hermes` references
+  the LiteLLM gateway at all. Raised 2026-09-14 by svos-dev, who reports the
+  operator believes Miranda runs on `gen-large` (free local). `gen-large` does
+  exist on LiteLLM. **Unresolved — do not repoint without the operator**, the
+  premise is his to confirm.
 - **bloom_music dev** — `~/development/bloom_music`; its `web/` test harness uses
   Playwright headless Chromium for OSMD browser-geometry assertions.
 - **The Booth** — ephemeral media drop board (`:8090`, `booth.service`), from