fix: give plugins the CLI reference in hermes chat -q/-Q too

PluginManager._cli_ref was set only by the interactive run loop
(_tui_init_run_state), so a one-shot query never bound it and
PluginContext.dispatch_tool injected no parent_agent into plugin tools. Bind it
once in _run_single_query_mode before the turn; the quiet, stream_json and
kanban-goal branches all pass through that line, and the interactive-seed
branch calls cli.run(), which already binds it.

Fixes #67597
credit: @webtecnica #67610 (slim redo at the current seam; #67611 and #67633 are later duplicates)

hermes_cli/cli_single_query.py

@@ -436,6 +436,10 @@ def _run_single_query_mode(cli, query, image, quiet, oneshot, stream_json: bool
         cli._seeded_first_message = _SeededQueryMessage(seeded_query, seeded_images)
         return cli.run()
     cli._single_query_mode = True  # agent waits the full MCP cold-start before its only tool snapshot
+    # Only the interactive run loop set this, so plugin tools dispatched from a `-q`/`-Q` turn got no
+    # parent_agent (PluginContext.dispatch_tool reads it) — #67597.
+    from hermes_cli.plugins import get_plugin_manager
+    get_plugin_manager()._cli_ref = cli
     # No user can answer approval prompts: the approval gate takes the deterministic path.
     # One-shot mode: no between-turns MCP late-binding refresh, so the agent must wait the full MCP
     # cold-start bound before its first (and only) tool snapshot. See #51316.