fix(agent): defer config validation to call time

Bundle top-level code runs during `workflow add` (descriptor extraction),
but agent config env vars (e.g. WORKFLOW_HERMES_COMMAND) are only available
at `workflow run` time. Deferring validation prevents premature throws.

packages/workflow-agent-hermes/__tests__/hermes-agent.test.ts

@@ -37,11 +37,11 @@ describe("validateHermesAgentConfig", () => {
 });
 
 describe("createHermesAgent", () => {
-  test("returns an AgentFn", () => {
+  test("returns an AgentFn even with invalid config (validation deferred to call)", () => {
     const agent = createHermesAgent({
       command: "/usr/local/bin/hermes",
       model: null,
-      timeout: null,
+      timeout: -5,
     });
     expect(typeof agent).toBe("function");
   });