fix(acp): avoid duplicate Hermes 0.21 replies

[matherring]

Summary

• Negotiate Hermes final-text fallback from the ACP agentInfo handshake rather than normalized command identity alone.
• Hermes 0.21+ publishes through the existing Buzz-managed terminal; buzz-acp neither captures nor submits a fallback reply.
• Missing, malformed, unrecognized, and pre-0.21 Hermes handshakes retain the existing signed fallback delivery.
• Preserve the fallback path’s NIP-10 root and parent tags; add no credential environment forwarding.

Validation

• cargo test -p buzz-acp (744 unit + 9 lifecycle tests)
• cargo fmt --check -p buzz-acp
• cargo clippy -p buzz-acp --tests -- -D warnings
• GitHub Actions on head: DCO, Semgrep OSS, zizmor, and Codex Security Review succeeded. The general CI workflow did not dispatch for this draft.

Draft opened early while work was in progress.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 5aed49b505a7e27f3b0e34dafa53d6c4e8cdcd64...271d2d031fead3ec9f5e2cb3cfa05d656ef2c02c.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 271d2d031fead3ec9f5e2cb3cfa05d656ef2c02c to authorize a new review.
Any previous review applies only to its recorded range.