Redact escaped single-quoted Hermes credentials

Decode native dotenv quote escapes before registering output redactions. Checks: 78 CLI and ACP event tests; native dotenv parser reproduction.

desktop/src/agents/cli/hermes-config-secrets.cjs

@@ -29,6 +29,7 @@ function hermesConfigSecrets({ env, home, platform, declaredKeys }) {
       if (/^['"]/.test(raw) && !quoted) continue
       let value = quoted ? quoted[2] : raw.replace(/\s+#.*$/, '').trim()
       if (quoted?.[1] === '"') value = value.replace(/\\([nr"\\])/g, (_, c) => ({ n: '\n', r: '\r', '"': '"', '\\': '\\' })[c])
+      if (quoted?.[1] === "'") value = value.replace(/\\(['\\])/g, '$1')
       value = value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g,
         (_, name, fallback) => Object.hasOwn(values, name) ? values[name] : fallback || '')
       values[key] = value

desktop/test/agents/cli/cli-process-support.test.cjs

@@ -118,12 +118,14 @@ test('Hermes native dotenv expansion redacts the values actually loaded by the C
     'CUSTOM_BASE=file-value#with-hash',
     "FIRST_API_KEY='${CUSTOM_BASE}'",
     'SECOND_TOKEN=${UNSET_MELDWORK_SECRET:-fallback-secret-value}',
+    "THIRD_API_KEY='escaped\\'credential'",
   ].join('\n'))
   const child = childEnvironment({ kind: 'hermes' }, home, {
     env: { HERMES_HOME: home, CUSTOM_BASE: 'stale-shell-value' },
     nativeCredentialKeys: ['CUSTOM_BASE'],
   }, process.platform)
-  assert.equal(redactChildSecrets('file-value#with-hash fallback-secret-value', child), '[redacted] [redacted]')
+  assert.equal(redactChildSecrets("file-value#with-hash fallback-secret-value escaped'credential", child),
+    '[redacted] [redacted] [redacted]')
 })
 
 test('Zcode receives its selected native home without changing other Agent homes', () => {