Track remaining Hermes MCP primary-error and authentication retry gaps

## Outcome

Track two non-blocking Hermes Streamable HTTP correctness gaps as a fast-follow after #10942 closes. The critical reconnect-exhaustion failure covered by #10945 is fixed in Hermes 0.19.1 and newer; NemoClaw currently pins Hermes 0.20.6.

## Remaining behavior

1. If a user operation fails and transport cleanup also fails, Hermes can replace the primary operation error with a cleanup or reconnect result.
2. An HTTP authentication failure can lose its status through MCP 2.0 error translation and be classified as transient, causing bounded retries before Hermes stops.

These are accepted as non-blocking for #10942. They remain correctness and diagnostic-quality gaps.

## Evidence

- Hermes 0.19.1 focused transport tests: 54 passed.
- Hermes 0.20.6 focused transport tests: 61 passed.
- NemoClaw managed MCP support tests: 58 passed.
- Twenty initialize, discovery, invocation, and session-close cycles completed with no file-descriptor growth, remaining tasks, child processes, or runtime warnings.
- Disconnect and cancellation cleanup completed without retrying the tool operation.
- Captured output contained no synthetic credential, authorization, or response-body markers.
- The critical reconnect change is Hermes commit `a8a93b6c681af377e5cffe65b3d69cfaba66c9c6`, first released in Hermes 0.19.1.
- NemoClaw `main` at `f72e8ff3592746131a633ae522454bde5b1aadbc` pins Hermes 0.20.6.

## Required behavior

- Preserve the primary connection, authentication, protocol, or tool-operation error when cleanup also fails.
- Report sanitized cleanup failure as secondary evidence.
- Treat a proven authentication failure as terminal and do not consume the reconnect budget.
- Close each response stream, session, client, and task group exactly once.
- Keep credentials, authorization headers, response bodies, and credential-bearing URLs out of logs and retained artifacts.

## Acceptance criteria

- Deterministic coverage proves that cleanup failure cannot replace the primary error.
- Deterministic coverage proves that authentication failure stops without reconnect attempts.
- Normal, disconnect, cancellation, and repeated-session cleanup remain leak-free.
- NemoClaw qualifies the exact accepted Hermes release and managed image.
- No NemoClaw compatibility workaround is added for behavior owned by Hermes or its MCP dependency.

## Delivery

Fast-follow after #10942 closes. This issue does not block #10942.

## Non-goals

- Add another MCP transport.
- Retry failed tool operations.
- Broaden reconnect policy beyond the two named cases.
- Weaken authentication or suppress cleanup warnings.

Start with the Hermes 0.20.6 focused transport tests and NemoClaw managed MCP support tests mentioned in the evidence, then inspect the dependency boundary around cleanup errors and authentication retries. Add deterministic coverage for primary-error preservation and terminal authentication failures, while confirming cleanup remains leak-free and the accepted Hermes release and managed image are qualified without a NemoClaw workaround.

Written by the indexing model from the issue text.