perf(config): read-only config loads on the ledger append and capture hot paths

_max_ledger_bytes() runs on every ledger append (right after ledger_enabled()
already deep-copied the config) and _computer_use_cfg() now runs twice per
computer-use capture; neither mutates the result, so use
load_config_readonly() as hermes_cli/config.py documents for read-only hot
paths (skips the deepcopy, ~half the cache-hit cost). Tests that patched
load_config now patch load_config_readonly as well (test-only edit).

PROOF: real import under PYTHONSAFEPATH shows load_config() ==
load_config_readonly() (same dict shape; defaults 5242880 / 200 resolve);
tests/tools/test_skill_ledger.py + test_computer_use_ax_walk_bound.py +
test_skill_ledger_delta.py -> 39 passed, 0 failed.

tests/tools/test_skill_ledger.py

@@ -624,8 +624,9 @@ def test_auto_compact_triggers_at_threshold(ledger_env, monkeypatch):
 
     import hermes_cli.config as _cfg
 
-    monkeypatch.setattr(_cfg, "load_config", lambda *a, **k: {
-        "skills": {"ledger_max_bytes": 8192}})
+    cap = {"skills": {"ledger_max_bytes": 8192}}
+    monkeypatch.setattr(_cfg, "load_config", lambda *a, **k: cap)
+    monkeypatch.setattr(_cfg, "load_config_readonly", lambda *a, **k: cap)
 
     first_id = skill_ledger.append_entry("patch", "my-skill", before=[], after=[])
     template = json.loads(skill_ledger.ledger_path().read_text().splitlines()[0])
@@ -662,6 +663,7 @@ def test_trim_oldest_when_still_over_cap(ledger_env, monkeypatch):
 
     cap = {"skills": {"ledger_max_bytes": 0}}  # no sweeps while seeding
     monkeypatch.setattr(_cfg, "load_config", lambda *a, **k: cap)
+    monkeypatch.setattr(_cfg, "load_config_readonly", lambda *a, **k: cap)
 
     newest_id = None
     for i in range(5):

tools/computer_use/cua_backend.py

@@ -38,8 +38,8 @@ _CUA_NATIVE_WAYLAND_ENV_VAR = "CUA_DRIVER_RS_ENABLE_WAYLAND"
 def _computer_use_cfg() -> Dict[str, Any]:
     """The ``computer_use`` config block, or ``{}`` when config is unreadable."""
     with contextlib.suppress(Exception):
-        from hermes_cli.config import load_config
-        return (load_config() or {}).get("computer_use") or {}
+        from hermes_cli.config import load_config_readonly  # per-capture hot path: no deepcopy
+        return (load_config_readonly() or {}).get("computer_use") or {}
     return {}
 
 def _cua_no_overlay() -> bool:

tools/skill_ledger.py

@@ -100,10 +100,10 @@ def _max_ledger_bytes() -> int:
     """Config ``skills.ledger_max_bytes`` (default 5 MB, 0 disables): above it the
     next append triggers the maintenance sweep instead of growing the file forever."""
     try:
-        from hermes_cli.config import cfg_get, load_config
+        from hermes_cli.config import cfg_get, load_config_readonly  # read-only hot path: no deepcopy
         return int(
             cfg_get(
-                load_config(), "skills", "ledger_max_bytes", default=5 * 1024 * 1024
+                load_config_readonly(), "skills", "ledger_max_bytes", default=5 * 1024 * 1024
             )
         )
     except Exception as e:  # pragma: no cover — best-effort config read