feat: add repository token attribution

[tevnull]

Summary

• Attribute Hermes session usage to privacy-safe Git repository identities using persisted repository/CWD metadata.
• Add versioned repository rollups, D1 storage, reconciliation, and backward-compatible ingest behavior.
• Add repository filtering and attribution coverage to the dashboard.
• Preserve atomic reads and writes across aggregate and repository dimensions.
• Preserve public API equivalent pricing and actual-cost behavior when repository filters are inactive; selected repositories avoid fabricating unavailable cost dimensions.
• Package a mandatory production installation checklist beside the plugin, with root and plugin-scoped AGENTS.md guidance.
• Define installation completion as a verified scheduled path—not merely plugin enablement or one manual sync.
• Make installer and wrapper command output direct agents toward idempotent cron reconciliation instead of unconditional job creation.

Verification

• uv run --with pytest pytest plugins/hermes-token-analytics/tests -q — 22 passed
• npm test — 77 passed
• npm run typecheck
• npm run build
• Installer exercised against a temporary Hermes target; packaged AGENTS.md and required checklist verified
• Markdown relative-link validation passed
• Bash/Python syntax, targeted ESLint, Prettier, and git diff --check passed
• Independent onboarding review — approved with no P0/P1 blockers
• GitHub CI: dashboard validation, plugin validation, change detection, and Cloudflare preview passed

Notes

Repository attribution is exact when Hermes records git_repo_root, derived when only cwd is available, and otherwise exported as Unattributed. Raw local paths and remote credentials are not published.

For production plugin installation or upgrades, follow plugins/hermes-token-analytics/REQUIRED_INSTALLATION_CHECKLIST.md. A task must be reported as partial/blocked when gateway reload, cron reconciliation, cron-triggered execution, or scheduled freshness verification remains incomplete.

[github-actions]

🚀 Cloudflare preview: https://token-usage-analytics-pr-54.tevpro.workers.dev