fix(tui): harden active-session temp file handling

- create HERMES_TUI_ACTIVE_SESSION_FILE with mkstemp instead of a predictable tmp path and always cleanup in finally
- add assertions that launch wiring uses a randomized session file path and removes it on exit

tests/hermes_cli/test_tui_resume_flow.py

@@ -145,6 +145,10 @@ def test_launch_tui_exports_model_and_provider(monkeypatch, main_mod):
     assert env["HERMES_INFERENCE_MODEL"] == "nous/hermes-test"
     assert env["HERMES_TUI_PROVIDER"] == "nous"
     assert env["HERMES_INFERENCE_PROVIDER"] == "nous"
+    active_path = Path(env["HERMES_TUI_ACTIVE_SESSION_FILE"])
+    assert active_path.name.startswith("hermes-tui-active-session-")
+    assert active_path.suffix == ".json"
+    assert not active_path.exists()
     assert env["NODE_ENV"] == "production"