fix(e2e): add sh/aws/hermes.sh and mark aws/hermes as implemented (#2042)

Hermes agent was fully implemented in shared/agent-setup.ts (createAgents
includes hermes with install, envVars, and launchCmd) but the convenience
shell script sh/aws/hermes.sh was missing and the matrix showed "missing".

- Add sh/aws/hermes.sh (matching pattern of all other aws agent scripts)
- Update manifest.json: "aws/hermes" -> "implemented"
- Update sh/aws/README.md with Hermes Agent install command

Discovered during QA E2E sweep: E2E suite lists hermes in ALL_AGENTS and
would attempt to provision it; without the matrix entry and script the
agent was silently untracked as a missing implementation gap.

Co-authored-by: spawn-qa-bot <qa@openrouter.ai>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

manifest.json

@@ -431,7 +431,7 @@
     "sprite/kilocode": "implemented",
     "local/hermes": "missing",
     "hetzner/hermes": "missing",
-    "aws/hermes": "missing",
+    "aws/hermes": "implemented",
     "daytona/hermes": "missing",
     "digitalocean/hermes": "missing",
     "gcp/hermes": "missing",

sh/aws/README.md

@@ -48,6 +48,12 @@ bash <(curl -fsSL https://openrouter.ai/labs/spawn/aws/opencode.sh)
 bash <(curl -fsSL https://openrouter.ai/labs/spawn/aws/kilocode.sh)
 ```
 
+#### Hermes Agent
+
+```bash
+bash <(curl -fsSL https://openrouter.ai/labs/spawn/aws/hermes.sh)
+```
+
 ## Non-Interactive Mode
 
 ```bash

sh/aws/hermes.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -eo pipefail
+
+# Thin shim: ensures bun is available, runs bundled aws.js (local or from GitHub release)
+
+_ensure_bun() {
+    if command -v bun &>/dev/null; then return 0; fi
+    printf '\033[0;36mInstalling bun...\033[0m\n' >&2
+    curl -fsSL --show-error https://bun.sh/install | bash >/dev/null || { printf '\033[0;31mFailed to install bun\033[0m\n' >&2; exit 1; }
+    export PATH="$HOME/.bun/bin:$PATH"
+    command -v bun &>/dev/null || { printf '\033[0;31mbun not found after install\033[0m\n' >&2; exit 1; }
+}
+
+_ensure_bun
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)"
+
+# SPAWN_CLI_DIR override — force local source (used by e2e tests)
+if [[ -n "${SPAWN_CLI_DIR:-}" && -f "$SPAWN_CLI_DIR/packages/cli/src/aws/main.ts" ]]; then
+    exec bun run "$SPAWN_CLI_DIR/packages/cli/src/aws/main.ts" hermes "$@"
+fi
+
+# Local checkout — run from source
+if [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/../../packages/cli/src/aws/main.ts" ]]; then
+    exec bun run "$SCRIPT_DIR/../../packages/cli/src/aws/main.ts" hermes "$@"
+fi
+
+# Remote — download and run compiled TypeScript bundle
+AWS_JS=$(mktemp)
+trap 'rm -f "$AWS_JS"' EXIT
+curl -fsSL "https://github.com/OpenRouterTeam/spawn/releases/download/aws-latest/aws.js" -o "$AWS_JS"
+exec bun run "$AWS_JS" hermes "$@"