hermes: add native tool deny configuration

[mostlydev]

Summary

• add service-level x-claw.hermes.disable-tools parsing and validation
• merge explicit denies with driver defaults while preserving allow-tools as the final override
• apply explicit denies to Telegram-only Hermes services and document the native-driver boundary

This uses the existing Hermes runtime filter. It does not add a parallel cllama filter or require a Hermes base-image change.

Verification

• go test ./...
• go vet ./...

Closes #341