Add the Hermes + QVAC beginner quickstart

[localhost41]

Summary

• add hermes-qvac start, a consent-gated beginner path using the official QVAC catalog, config synthesizer, and managed supervisor
• present the project as Hermes + QVAC Quickstart while retaining the npm, CLI, and provider identifiers
• add persistent --fast (4B/16K/terminal tools) and --full (9B/32K/full tools) profiles
• run official qvac doctor --json before setup or model download
• add a sanitized direct-versus-Hermes performance-attribution harness
• persist explicit beginner choices transactionally and restore prior configuration if setup fails

Evidence

macOS arm64, Node 26.3.0, Hermes 0.19.0, Python 3.11.15, QVAC CLI 0.8.1, 16 GiB:

• exact packed beta.3 tarball installed into a fresh npm prefix
• fresh packed fast-profile run: exact OK, 37 seconds, cleanup passed
• repeated packed run: inherited fast profile, exact OK, 19 seconds, cleanup passed
• uninstall removed discovery and preserved saved configuration
• cold-boundary fast run downloaded the remaining 2.55 GiB and completed in 124 seconds
• cached source fast runs completed in 18–20 seconds

Controlled warmed request means, three repetitions per lane:

Model/lane	Mean
9B direct minimal	0.38 s
9B normal Hermes, 28 tools	97.84 s
9B terminal-only Hermes, 2 tools	22.69 s
4B direct minimal	0.21 s
4B normal Hermes, 28 tools	59.36 s
4B terminal-only Hermes, 2 tools	12.79 s

The benchmark omits credentials, request bodies, and full prompts.

Verification

• pnpm test — 95 passed
• pnpm test:python — 24 passed
• pnpm lint — passed
• pnpm verify:metadata — passed
• pnpm audit --prod --audit-level=high — no known vulnerabilities
• pnpm verify:package — passed
• pnpm verify:artifact — passed from clean commit fd926e635b18f4fcd77e996279e7e6cb4fd3d293

Exact artifact rehearsal:

• localhost41-hermes-qvac-provider-0.1.0-beta.3.tgz
• SHA-256 5379c67b1347ce19740c21f897f750b7c8f66b6899b563fcf823f4f2f2f094df
• 57,829 packed bytes; 210,994 unpacked bytes; 27 files

Limitations

• Hermes remains a prerequisite.
• Live evidence in this PR is macOS arm64; Linux remains a protected release gate and native Windows is not claimed.
• The fast profile reduces the Hermes tool surface and does not claim full-agent task parity.
• Existing QVAC context-boundary and structured-output defects remain visible and are not patched here.
• This remains an independent community integration, not an official or endorsed component.

latest must remain unchanged; beta publication is performed only through the protected prerelease workflow after merge and green CI.