[low] includes('404') on error messages turns 500s into "not found" #496

Severity: low

• Verdict: CONFIRMED (7 occurrences in plugin-client.ts; ': 404' / ': 405' at hermes-api.ts:463,554)
• Body: the message embeds the path and response body, so run-404abc or a 500 body can trigger the branch. Attach status to thrown errors.
• Evidence: plugin-client.ts:196,267,341,373,451,463,502.

Source: docs/overnight-2026-10-26/issues-draft.md § C8
Filed from the 2026-10-26 overnight audit (read-only findings, not yet triaged).