Release OV (v0.51.435): supported local pytest runner (#3908) (#4252)

* stage-3908: supported local pytest runner + symlink-guard on venv create/clear (Codex CORE fix)

Rebased rodboev/franksong2702 #3908 onto v0.51.434. Adds scripts/test.sh dev
runner + requirements-dev.txt + test_ci_hygiene.py + conftest version guard.
Defensive fix on the authoritative gate: create_or_rebuild_venv refuses a
symlinked .venv so 'python -m venv --clear' can't wipe the symlink target
(same symlink-hardening class as #4217/#4234/#4240). Locked by a hygiene test.

* Release OV: supported local pytest runner (#3908)

scripts/test.sh + requirements-dev.txt + conftest version guard + hygiene tests.
Self-rebased franksong2702's #3908 onto v0.51.434; full Codex+Opus+suite gate.
Codex CORE fix applied: refuse to create/--clear a virtualenv through a symlinked
.venv (symlink-hardening class, #4217/#4234/#4240), locked by a hygiene assertion.

Co-authored-by: franksong2702 <franksong2702@users.noreply.github.com>

---------

Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
Co-authored-by: franksong2702 <franksong2702@users.noreply.github.com>

README.md

@@ -473,18 +473,31 @@ For the deep dive on each of these, see [`docs/docker.md`](docs/docker.md).
 ## Running tests
 
 Tests discover the repo and the Hermes agent dynamically -- no hardcoded paths.
+Use the repo test runner so local runs do not accidentally use an unsupported
+system Python. It creates/uses `.venv` with Python 3.11, 3.12, or 3.13 and
+installs the dev test dependencies from `requirements-dev.txt` when missing.
 
 ```bash
 cd hermes-webui
-pytest tests/ -v --timeout=60
+./scripts/test.sh
 ```
 
-Or using the agent venv explicitly:
+Pass normal pytest arguments after the script for focused runs:
 
 ```bash
-/path/to/hermes-agent/venv/bin/python -m pytest tests/ -v
+./scripts/test.sh tests/test_regressions.py -v
 ```
 
+Or seed the repo `.venv` from an explicit supported base interpreter:
+
+```bash
+HERMES_WEBUI_TEST_PYTHON=/path/to/python3.12 ./scripts/test.sh tests/ -v
+```
+
+The override selects the Python used to create or rebuild `.venv`; dependencies
+are still installed into the repo-local virtual environment, not into the
+system/Homebrew interpreter.
+
 Tests run against an isolated server with a separate state directory.
 Production data and real cron jobs are never touched. Current snapshot:
 **~7,150 tests collected** across **~700 test files**, run in CI on Python 3.11,