fix: bump hermes-agent 0.3.0 → 0.4.0, fix CI update script targeting wrong fields

- Stable: pinVersion 0.3.0 → 0.4.0 (v2026.3.23, commit 8416bc2)
- Nightly: 0.3.0-unstable-2026-03-22 → 0.4.0-unstable-2026-03-25 (commit e5691ee)
- Fix update-pins.sh: target pinVersion/pinRev/pinHash instead of generic
  version/rev/hash which incorrectly matched fal-client fields
- Add cherrypy test override for macOS Nix sandbox compatibility
- No litellm: pythonRemoveDeps still strips it from wheel metadata

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.nix

@@ -9,9 +9,9 @@
   ripgrep,
   ffmpeg,
   git,
-  pinVersion ? "0.3.0",
-  pinRev ? "6ebb816e5611aaf1f3f7187ba8b10e985e899c75",
-  pinHash ? "sha256-JGjusff/jGjvCCdUtl9IErBTGmpIq6BVA5Gj8mwqVYg=",
+  pinVersion ? "0.4.0",
+  pinRev ? "8416bc2142ad7494b3d72b055cd5a86a80472fe4",
+  pinHash ? "sha256-dKilXoJbu5thhCRpDYKTX9fAOq1JTqdBvuf9Ji1iY64=",
 }:
 
 let
@@ -26,6 +26,10 @@ let
         # pytest-services fails with PermissionError in Nix sandbox (/tmp/service-locks)
         doCheck = false;
       });
+      cherrypy = prev.cherrypy.overridePythonAttrs (_old: {
+        # cherrypy test_logging tests crash in macOS Nix sandbox (signal 0)
+        doCheck = false;
+      });
     };
   };
   pythonPackages = python.pkgs;