test(skills): assert only the pooled client's timeout and redirect policy

The inspect-pooling test compared the full constructor kwarg dict, so
any harmless future kwarg (e.g. headers=) would flip it without a
behaviour change. Assert the two properties it actually proves.

PROOF: dropping `timeout=` from the pooled create_ssrf_safe_client call
(tools/skills_hub.py:104) fails with KeyError at the timeout assertion;
changing it to `_DEFAULT_HTTP_TIMEOUT + 1` fails `assert 21 == 20`.
Reverted; tests/hermes_cli/test_skills_hub.py 12 passed.

tests/hermes_cli/test_skills_hub.py

@@ -343,7 +343,8 @@ def test_inspect_reuses_one_ssrf_safe_client_for_metadata_and_bundle(monkeypatch
     assert result is not None
     assert len(clients) == 1
     # The pooled client keeps the one-shot default timeout and never auto-follows redirects.
-    assert client_kwargs == [{"timeout": hub._DEFAULT_HTTP_TIMEOUT, "follow_redirects": False}]
+    assert client_kwargs[0]["timeout"] == hub._DEFAULT_HTTP_TIMEOUT
+    assert client_kwargs[0]["follow_redirects"] is False