fix: apply Opus+Codex gate findings — stale-stopped not configured (#1944), narrow #2905 markers, scope except

Both pre-release reviewers (Opus advisor + Codex regression gate) converged on
the same MUST-FIX:

- #3194: treating gateway_stale_stopped_state as 'configured' contradicted
  #1944 (a stopped root gateway should read like 'not configured' so the
  banner doesn't nag). Now ONLY stale-RUNNING metadata
  (reason=gateway_stale_running_state or gateway_state=='running') flips
  configured=True; stale-stopped falls through to bool(identity_map) like the
  genuinely-unconfigured case. Updated the test accordingly + added a
  stale-stopped no-regression test.

Opus follow-ups also applied:
- #2905: narrowed the populated-home markers to WebUI-only artifacts
  (webui/, webui/sessions, webui/settings.json), dropping config.yaml/auth.json
  so a long-time agent user installing WebUI fresh isn't wrongly diverted to
  the legacy %USERPROFILE%\.hermes (auth.json predates #2897 there).
- profiles._resolve_base_hermes_home(): narrowed except Exception -> ImportError
  so a real bug in the config helper still surfaces.

Adjacent suites green: #2840, #1879, gateway_status_agent_health (66 tests).

tests/test_issue2905_windows_home_migration_safety.py

@@ -174,14 +174,23 @@ class TestHermesHomeHasWebuiState:
         (tmp_path / "webui" / "sessions").mkdir(parents=True)
         assert config._hermes_home_has_webui_state(tmp_path) is True
 
-    def test_config_yaml_marker_counts(self, tmp_path):
-        (tmp_path / "config.yaml").write_text("x: 1\n", encoding="utf-8")
+    def test_webui_settings_marker_counts(self, tmp_path):
+        (tmp_path / "webui").mkdir()
+        (tmp_path / "webui" / "settings.json").write_text("{}", encoding="utf-8")
         assert config._hermes_home_has_webui_state(tmp_path) is True
 
-    def test_auth_json_marker_counts(self, tmp_path):
-        (tmp_path / "auth.json").write_text("{}", encoding="utf-8")
+    def test_webui_dir_alone_counts(self, tmp_path):
+        (tmp_path / "webui").mkdir()
         assert config._hermes_home_has_webui_state(tmp_path) is True
 
+    def test_agent_only_artifacts_do_not_count(self, tmp_path):
+        """A home with ONLY agent files (config.yaml / auth.json) and no webui/
+        dir is NOT treated as WebUI state — otherwise a long-time agent user
+        installing WebUI fresh would be wrongly diverted to the legacy dir."""
+        (tmp_path / "config.yaml").write_text("model: x\n", encoding="utf-8")
+        (tmp_path / "auth.json").write_text("{}", encoding="utf-8")
+        assert config._hermes_home_has_webui_state(tmp_path) is False
+
 
 def test_profiles_base_home_delegates_to_config(monkeypatch, tmp_path):
     """profiles._resolve_base_hermes_home() must share config's resolution so