test(auth): stub gh_cli resolver in copilot suppress test

PR #31416 added a prune step that drops 'borrowed' credential-pool
entries (gh_cli, env:*, etc.) on load when their source isn't
currently active. In production the copilot gh_cli entry is kept
alive each load by resolve_copilot_token() returning the live
`gh auth token` output.

The test wrote a gh_cli copilot row directly into auth.json but
didn't stub resolve_copilot_token, so under the new policy that
entry was pruned before resolve_target("1") could find it, causing
`SystemExit: No credential #1`.

Stub resolve_copilot_token + get_copilot_api_token so the seeded
entry survives the load, then auth_remove_command can target it
and write the suppression flags the test asserts on.

All 46 tests in tests/hermes_cli/test_auth_commands.py pass.

tests/hermes_cli/test_auth_commands.py

@@ -1611,6 +1611,22 @@ def test_auth_remove_copilot_suppresses_all_variants(tmp_path, monkeypatch):
     from hermes_cli.auth import is_source_suppressed
     from hermes_cli.auth_commands import auth_remove_command
 
+    # PR #31416 prunes "borrowed" pool entries whose source isn't currently
+    # active.  In production the copilot gh_cli entry is kept alive each
+    # load by `resolve_copilot_token()` returning the live `gh auth token`
+    # output.  In tests there's no `gh` CLI, so stub the resolver so the
+    # seeded entry survives the load → resolve_target round trip.
+    monkeypatch.setattr(
+        "hermes_cli.copilot_auth.resolve_copilot_token",
+        lambda: ("ghp_fake", "gh"),
+        raising=False,
+    )
+    monkeypatch.setattr(
+        "hermes_cli.copilot_auth.get_copilot_api_token",
+        lambda token: token,
+        raising=False,
+    )
+
     auth_remove_command(SimpleNamespace(provider="copilot", target="1"))
 
     assert is_source_suppressed("copilot", "gh_cli")