Release CR: stage-batch2 — 3-PR low-risk batch (v0.51.120) — Bedrock provider / update past-tag / CORS preflight

[nesquena-hermes]

Release CR — v0.51.120 — stage-batch2 — 3-PR low-risk batch

Second batch from the May 24 sweep. Three contributor PRs that are mechanical, well-tested, and pre-cleared by Opus advisor:

PR	Author	LOC	Surface	Risk
#2786	@munim	+113/-0	api/config.py provider registry	low — pure additive, hermes_cli runtime path is source-of-truth, 11 new tests
#2789	@munim	+123/-0	api/updates.py post-tag fall-through	low — narrows a false "Up to date" signal, 8 new tests cover edge cases
#2790	@weidzhou	+9/-0	server.py do_OPTIONS handler	low — minimal-split resubmit of closed #2750

Cherry-picks

d7f1514d fix(models): surface bedrock provider in WebUI model picker (#2720)   (#2786)
d04805b0 fix(updates): fall through to branch check when HEAD is past latest tag (#2789)
acda74e5 fix: add do_OPTIONS handler for CORS preflight requests              (#2790)
60eb6f53 Stamp CHANGELOG for v0.51.120

Pre-Opus gate

Check	Result
Python ast.parse on all touched .py	PASS
Merge-marker grep	clean
CHANGELOG placeholder grep	clean
Cross-stage surface overlap check	clean (config.py / updates.py / server.py — no shared functions)
New regression tests (19)	pass in isolation
Full pytest	6267 passed, 7 skipped, 0 failed

Opus advisor verdict

SHIP all three. Severity for any concerns: informational only (no blockers).

• fix(models): surface AWS Bedrock provider in WebUI model picker #2786: Fills a known gap; canonical slug already declared via aliases at config.py:754; CLI live-path is source-of-truth, static list is fallback
• fix(updates): fall through to branch check when HEAD is past latest tag (#2653) #2789: Untagged-repo path returns None at updates.py:379 before new code; describe parsing is whitespace-safe via _run_git strip
• fix: add do_OPTIONS handler for CORS preflight requests #2790: Permissive-preflight + restrictive-actual posture is sound; CSRF protection at server.py:1264 untouched; matches minimal split requested in closed fix: add do_OPTIONS handler for CORS preflight requests #2750

What's NOT in this batch

• harden(start.ps1): TryParse HERMES_WEBUI_PORT + exit AFTER try/finally cleanup #2807 / docs(start.ps1+README): clarify native Windows venv path; remove misleading WSL2-venv-portability claim #2806 (Windows start.ps1) — stacked on feat(start.ps1): expand hermes-agent candidate paths for Windows installers #2805 (CONFLICTING with master), needs author rebase
• fix: prevent state.db messages being silently dropped during sidecar merge #2788 (state.db merge), fix: align messaging session display counts #2797 (display counts), fix(compression): ignore tool output for compaction cards #2803 (compression marker) — touch DB merge or api/streaming.py, deferred to Batch 3 with closer scrutiny
• fix(chat): #2565 reset reasoning accumulator per turn and prefer reasoning_content #2778 / fix(chat): #2713 flush pending render before segment reset at tool/interim #2777 (chat reasoning + segment flush) — by @b3nw, larger surface, defer to next batch
• perf(static): gzip + ETag/304 + immutable cache for fingerprinted /st… #2779 (gzip + ETag for static) — perf change, deserves its own review