[Hermes] Oneshot provider failure is printed but the command exits 0

## Severity

P2

## Environment

- NemoClaw v0.0.124
- OpenShell 0.0.116
- Hermes 0.20.6
- OpenRouter managed inference

## Description

A Hermes oneshot request exhausted its three automatic retries after the provider returned HTTP 429. The CLI printed API call failed after 3 retries: HTTP 429: Provider returned error, but the enclosing OpenShell exec process exited 0.

The provider 429 is not itself asserted to be a NemoClaw defect. The defect is the success exit status after Hermes reports that no answer was produced. Earlier chat, tool, and HTTP inference requests succeeded, so this report does not claim an invalid credential or a generally broken inference route.

## Reproducer

1. Onboard a supported Hermes sandbox.
2. Invoke a Hermes oneshot through the canonical sandbox exec path.
3. Cause or observe a bounded provider failure that exhausts Hermes retries, such as a provider HTTP 429.
4. Capture the user-visible failure text and enclosing process exit code.

## Observed behavior

Hermes prints that the API call failed after three retries, but the enclosing command exits 0.

## Expected behavior

A oneshot that exhausts retries without producing an assistant result exits nonzero and preserves a concise provider-failure diagnostic. Automation must not record the request as successful.

## Acceptance criteria

- [ ] Isolate whether Hermes itself or the NemoClaw/OpenShell wrapper converts the failed turn to exit 0.
- [ ] A deterministic provider-error fixture exhausts the supported retry path without live provider dependence.
- [ ] A failed oneshot with no assistant result returns a documented nonzero exit code.
- [ ] A successful oneshot continues to exit 0.
- [ ] Retry and provider diagnostics remain visible without exposing credentials, endpoints, request identifiers, or response bodies.
- [ ] Tests cover at least rate-limit, authentication, and generic upstream failure classifications without asserting that every provider 429 is a NemoClaw defect.

Start at the canonical sandbox exec path and trace whether Hermes or the NemoClaw/OpenShell wrapper turns an exhausted oneshot failure into exit 0. Add a deterministic provider-error fixture covering rate-limit, authentication, and generic upstream failures, then verify that failed requests without an assistant result exit nonzero while successful ones still exit 0 and diagnostics remain safe.

Written by the indexing model from the issue text.