opentui(phase3): launcher integration — HERMES_TUI_ENGINE dual-engine

hermes --tui launches the native OpenTUI engine (Bun) when
HERMES_TUI_ENGINE=opentui (env) or display.tui_engine=opentui (config);
Ink stays the default and the shipping path is untouched.

- _resolve_tui_engine() (env > config > ink); refuses opentui on
  Windows/Termux (no Bun) -> falls back to ink with a notice.
- _make_opentui_argv() -> [bun, src/entry.real.tsx] (no build step).
- _bun_bin() with HERMES_BUN override.
- Branch at top of _make_tui_argv BEFORE _ensure_tui_node (Bun-only host
  must not bootstrap Node).
- Gate _launch_tui NODE_OPTIONS/--max-old-space-size on engine==ink (Bun
  is JSC; the V8 flag errors/ignores).

Verified end-to-end via tmux: real hermes --tui -> Bun -> OpenTUI ->
real Python gateway streamed a real reply. No-flag default still ink.

tests/hermes_cli/test_auth_manual_paste.py

@@ -465,7 +465,7 @@ def test_xai_loopback_login_manual_paste_missing_code_raises(monkeypatch):
 
 
 def test_xai_loopback_login_timeout_falls_back_to_manual_paste(monkeypatch):
-    """Loopback timeout should accept a bare Grok Build code paste."""
+    """Loopback timeout should offer the existing manual-paste path."""
     monkeypatch.setattr(
         auth_mod, "_xai_oauth_discovery",
         lambda *_a, **_k: {
@@ -523,7 +523,7 @@ def test_xai_loopback_login_timeout_falls_back_to_manual_paste(monkeypatch):
         captured["prompt_calls"] += 1
         return {
             "code": "manual-auth-code",
-            "state": None,
+            "state": captured["state"],
             "error": None,
             "error_description": None,
         }
@@ -558,48 +558,6 @@ def test_xai_loopback_login_timeout_falls_back_to_manual_paste(monkeypatch):
     assert creds["tokens"]["refresh_token"] == "rt-timeout"
 
 
-def test_xai_wait_for_callback_accepts_ready_stdin_code(monkeypatch):
-    """Users can paste the Grok Build code while Hermes is still waiting."""
-    class _StubServer:
-        shutdown_called = False
-        close_called = False
-
-        def shutdown(self):
-            self.shutdown_called = True
-
-        def server_close(self):
-            self.close_called = True
-
-    class _StubThread:
-        joined = False
-
-        def join(self, timeout=None):
-            self.joined = True
-
-    server = _StubServer()
-    thread = _StubThread()
-    monkeypatch.setattr(
-        auth_mod,
-        "_read_ready_stdin_line",
-        lambda: "ready-grok-build-code\n",
-    )
-
-    out = auth_mod._xai_wait_for_callback(
-        server,
-        thread,
-        {"code": None, "error": None},
-        timeout_seconds=5,
-        manual_paste_redirect_uri="http://127.0.0.1:56121/callback",
-    )
-
-    assert out["code"] == "ready-grok-build-code"
-    assert out["state"] is None
-    assert out["_manual_paste"] is True
-    assert server.shutdown_called is True
-    assert server.close_called is True
-    assert thread.joined is True
-
-
 def test_xai_loopback_login_timeout_noninteractive_reraises(monkeypatch):
     """Non-interactive stdin must keep the original timeout error."""
     monkeypatch.setattr(