Code-health ratchet: hermes_cli/config.py was 4268 lines > its 4249 cap after the bare-model container refusal grew the section guard. Move the guard verbatim into a topical sibling; set_config_value late-imports it, and the sibling late-imports _exit_invalid, so there is no module-level facade<->sibling cycle. No shim left behind; no test patches the old path.