chore: stage locally validated Hermes verifier fixes

Author: sunnylqm

.github/workflows/hermes-review-submit.yml

@@ -0,0 +1,35 @@
+name: Stage reviewed Hermes fix
+
+on:
+  push:
+    branches: [codex/hermes-base-submit-20260912]
+
+permissions:
+  contents: write
+
+jobs:
+  stage:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+      - name: Apply the locally tested patch on the audited commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          cat .hermes-patch/{0,1,2,3}.xzpart | xz -dc > "$RUNNER_TEMP/hermes-base.patch"
+          echo "49b2915549fefd1dfeb4f5d9fc1274d945d12ebfd37855fe7a6e4442eb291d26  $RUNNER_TEMP/hermes-base.patch" | sha256sum --check
+          git switch --detach 88b2e66743033c38657b0aa97ab4c3acda6bd3c2
+          git apply --check --unidiff-zero --exclude=.github/workflows/test.yml "$RUNNER_TEMP/hermes-base.patch"
+          git apply --index --unidiff-zero --exclude=.github/workflows/test.yml "$RUNNER_TEMP/hermes-base.patch"
+          git diff --cached --check
+          git diff --cached --stat
+          test "$(git diff --cached --name-only | wc -l)" -eq 14
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git commit -m 'fix(hermes-base): preserve semantic operands and bound verifier processes'
+          git push origin HEAD:refs/heads/codex/hermes-base-staged-20260912
+          git rev-parse HEAD HEAD^{tree}