fix(studio): isolate Hermes dashboard settings to VeStack

[Xiaoaier-Z-L]

Summary

Fix the public-cloud Hermes regression introduced by #1057: VeStack dashboard settings were applied unconditionally to all deployments.

Changes

• Gate surface_path, surface_start_command and surface_ready_path on is_vestack_deployment.
• Public cloud restores the original /hermes/ entry point and empty dashboard startup/readiness settings.
• VeStack retains /proxy/4500/ and its existing dashboard settings.
• Add regression tests evaluating the actual CLI registration for both modes and verifying public-cloud session creation/opening does not invoke dashboard HTTP requests.

Scope

Only the Hermes registration and regression tests: 2 files, 1 commit. No Codex connection, model defaults, IAM, OAuth, frontend assets or credentials changes.

Validation

• User verified the original fix locally.
• Based on upstream main 43ce978; tests adapted to its sandbox service refactor.
• pytest -q tests/cli/test_frontend_sandbox.py tests/cli/test_vestack_studio_deploy.py tests/cli/test_codex_app_server.py: 145 passed, 5 deprecation warnings.
• pre-commit: Ruff lint, formatting and gitleaks passed.
• git diff --check passed.
• No deployment performed. CI and changed-line coverage remain to be verified; human review required.