Hermes v2026.7.1 tags the security wave that was main-only last issue

What this changes for operators

• Hermes v2026.7.1 ships the prior main-only wave: MCP-config persistence hardening, cron base_url credential-exfiltration blocking, prefix-secret sentinels for file reads, Slack xapp- token redaction, browser cloud-metadata guardrails, resume/session scoping, and a dependency floor.
• Upgrade from v2026.6.19 if you were waiting for a tag. The channel question changed from 'run main or wait' to a normal release upgrade.