feat(backup): exclude checkpoints/ from backups (#16572)

Session-local trajectory cache — keyed by session hash, regenerated
per-session, won't port to another machine anyway. On a large install
this was multiple GB of pure noise in every zip.

Also adds a regression test for the pre-existing backups/ exclusion
so the two machine-local dirs share coverage.

hermes_cli/backup.py

@@ -37,6 +37,8 @@ _EXCLUDED_DIRS = {
     ".git",             # nested git dirs (profiles shouldn't have these, but safety)
     "node_modules",     # js deps if website/ somehow leaks in
     "backups",          # prior auto-backups — don't nest backups exponentially
+    "checkpoints",      # session-local trajectory caches — regenerated per-session,
+                        # session-hash-keyed so they don't port to another machine anyway
 }
 
 # File-name suffixes to skip

tests/hermes_cli/test_backup.py

@@ -91,6 +91,18 @@ class TestShouldExclude:
         assert _should_exclude(Path("gateway.pid"))
         assert _should_exclude(Path("cron.pid"))
 
+    def test_excludes_checkpoints(self):
+        """checkpoints/ is session-local trajectory cache — hash-keyed,
+        regenerated per-session, won't port to another machine anyway."""
+        from hermes_cli.backup import _should_exclude
+        assert _should_exclude(Path("checkpoints/abc123/trajectory.json"))
+        assert _should_exclude(Path("checkpoints/deadbeef/step_0001.json"))
+
+    def test_excludes_backups_dir(self):
+        """backups/ is excluded so pre-update backups don't nest exponentially."""
+        from hermes_cli.backup import _should_exclude
+        assert _should_exclude(Path("backups/pre-update-2026-04-27-063400.zip"))
+
     def test_includes_config(self):
         from hermes_cli.backup import _should_exclude
         assert not _should_exclude(Path("config.yaml"))