fix(packaging): ship locales/ i18n catalogs in wheel, sdist, and Nix (#38383)

* fix(packaging): ship locales/ i18n catalogs in wheel, sdist, and Nix

locales/ is a bare data dir (no __init__.py), invisible to packages.find
and package-data. Sealed installs (pip wheel, Nix store venv) dropped it,
so gateway/CLI commands rendered raw i18n keys like
gateway.reset.header_default.

- pyproject: [tool.setuptools.data-files] locales = ["locales/*.yaml"] (wheel)
- MANIFEST.in: graft locales (sdist)
- agent/i18n._locales_dir: env override -> source -> sysconfig data scheme
- nix/hermes-agent.nix: copy locales into the store + set HERMES_BUNDLED_LOCALES
  as defense-in-depth. The wheel's data-files already materialize into the
  uv2nix venv, so resolution works with no env var; the override pins the
  store path against a future uv2nix change that could drop data-files.
- tests: metadata regression, wheel + sdist build-install smoke tests, and a
  bundled-locales flake check that verifies BOTH the wrapper override and the
  env-var-less data-files path. Smoke test wired into CI.

Closes #23943, #27632, #35374.
Supersedes #23966, #27716, #30261, #33841, #35429, #35494, #35735, #36697.

* test: cap locale e2e timeout, tighten catalog count guard

The two wheel/sdist e2e tests inherit the global --timeout=30 from
addopts; a cold-CI run (isolated build env + venv create + network pip
install) can plausibly exceed it. Add @pytest.mark.timeout(300) so they
don't ride the unit-test budget and flake intermittently.

Also assert the shipped catalog count equals len(SUPPORTED_LANGUAGES)
instead of a hardcoded >=16 floor, so the guard self-updates and trips
on a single dropped catalog (not just a fully-empty graft).

tests/agent/test_i18n.py

@@ -167,3 +167,63 @@ def test_t_missing_key_in_non_english_falls_back_to_english(tmp_path, monkeypatc
 def test_t_unknown_language_uses_english():
     """Unknown lang codes normalize to English, not to a key-path fallback."""
     assert i18n.t("approval.denied", lang="klingon") == i18n.t("approval.denied", lang="en")
+
+
+# ---------------------------------------------------------------------------
+# _locales_dir resolution ladder -- regression for #23943 / #27632 / #35374.
+# Sealed installs (Nix store venv, pip wheel) have no source tree next to
+# agent/, so _locales_dir must resolve via env override or the data scheme.
+# ---------------------------------------------------------------------------
+
+def test_locales_dir_env_override_used_when_dir_exists(tmp_path, monkeypatch):
+    """HERMES_BUNDLED_LOCALES wins when it points at a real directory."""
+    bundled = tmp_path / "bundled-locales"
+    bundled.mkdir()
+    monkeypatch.setenv("HERMES_BUNDLED_LOCALES", str(bundled))
+    assert i18n._locales_dir() == bundled
+
+
+def test_locales_dir_env_override_ignored_when_missing(tmp_path, monkeypatch):
+    """A bogus HERMES_BUNDLED_LOCALES falls through to source/wheel resolution
+    instead of returning a path that doesn't exist."""
+    monkeypatch.setenv("HERMES_BUNDLED_LOCALES", str(tmp_path / "does-not-exist"))
+    result = i18n._locales_dir()
+    assert result != tmp_path / "does-not-exist"
+    # In a source checkout this is the repo-root locales dir.
+    assert result.name == "locales"
+
+
+def test_locales_dir_falls_back_to_data_scheme(tmp_path, monkeypatch):
+    """When neither the env override nor a source-adjacent locales/ exists,
+    _locales_dir uses sysconfig's data scheme (the pip-wheel layout)."""
+    import sysconfig
+
+    # No env override.
+    monkeypatch.delenv("HERMES_BUNDLED_LOCALES", raising=False)
+
+    # Force the source-adjacent path to a location with no locales/ dir.
+    fake_pkg = tmp_path / "site-packages" / "agent"
+    fake_pkg.mkdir(parents=True)
+    monkeypatch.setattr(i18n, "__file__", str(fake_pkg / "i18n.py"))
+
+    # Stand up a fake data scheme containing locales/.
+    data_root = tmp_path / "data-scheme"
+    (data_root / "locales").mkdir(parents=True)
+    real_get_path = sysconfig.get_path
+
+    def fake_get_path(name, *args, **kwargs):
+        if name == "data":
+            return str(data_root)
+        return real_get_path(name, *args, **kwargs)
+
+    monkeypatch.setattr(i18n.sysconfig, "get_path", fake_get_path)
+
+    assert i18n._locales_dir() == data_root / "locales"
+
+
+def test_t_resolves_real_string_in_source_checkout():
+    """Sanity: in the test environment (a source checkout) t() must return a
+    human string, never the bare key path. Guards against catalog-load
+    regressions independent of packaging."""
+    assert i18n.t("gateway.reset.header_default", lang="en") != "gateway.reset.header_default"
+    assert i18n.t("gateway.status.header", lang="en") != "gateway.status.header"