fix(environments): move CWD tracking from remote file to in-band stdout

Previously, _wrap_command() wrote pwd to a file on the remote (container,
sandbox, SSH host), then _update_cwd_from_file() read it back via another
_run_bash() call. On Modal/Daytona this was a full API round-trip just to
read 20 bytes.

Now the wrapping template echoes the cwd to stdout with markers:
  printf '\n__HERMES_CWD__%s__HERMES_CWD__\n' "$(pwd -P)"

_extract_cwd_from_output() parses it from the output already in memory.
Zero extra round-trips on any backend. The cwdfile, _read_file_in_env(),
and per-backend overrides are all deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tools/environments/ssh.py

@@ -181,26 +181,10 @@ class SSHEnvironment(BaseEnvironment):
             stdin=subprocess.DEVNULL, text=True,
         )
 
-    def _read_file_in_env(self, path: str) -> str:
-        """SSH override: use subprocess.run for single-shot cat, suppress stderr.
-
-        SSH connection warnings (post-quantum, etc.) must not pollute
-        the cwdfile read — use separate stderr to discard them.
-        """
-        cmd = self._build_ssh_command()
-        cmd.append(f"cat {shlex.quote(path)} 2>/dev/null")
-        try:
-            result = subprocess.run(
-                cmd, capture_output=True, text=True, timeout=10,
-            )
-            return result.stdout
-        except (subprocess.TimeoutExpired, OSError):
-            return ""
-
     def cleanup(self):
-        # Clean up remote snapshot and cwdfile before closing ControlMaster
-        if self._snapshot_path or self._cwdfile_path:
-            paths = " ".join(p for p in (self._snapshot_path, self._cwdfile_path) if p)
+        # Clean up remote snapshot before closing ControlMaster
+        if self._snapshot_path:
+            paths = self._snapshot_path
             try:
                 cmd = self._build_ssh_command()
                 cmd.append(f"rm -f {paths}")