Wrap Hermes Agent in a leash: USD caps + egress allowlist + audit log in 30 lines (Web Pulse, 2026)