N0: rename Hermes → Nomos (standalone commit)

Problem: "Hermes" collides with Nous Researchs unrelated product;
  unclear identity for the resident agent.

  Change: Rename the live service identity across 39 files:
  - cmd/hermes/ → cmd/nomos/ (binary, env vars NOMOS_*)
  - internal/config/ server.go (NomosAgentSlug, nomosAgentID)
  - compose/hermes/ → compose/nomos/ (Dockerfile, service name)
  - hermes/ → nomos/ (SOUL.md, config.yaml, skills/)
  - .agents/HERMES.md → NOMOS.md (persona)
  - tools/setup-hermes-soul.sh → setup-nomos-soul.sh
  - seeds/inventory.yaml (agent:hermes → agent:nomos)
  - migrations/014_rename_agent_hermes_to_nomos.up.sql
  - Caddy vhost hermes.hubris.network → nomos.hubris.network
  - All referencing docs, scripts, ADR notes

  History preserved: archive/, plans/done/, ADRs not rewritten.
  Matrix @hermes notifier account and Legacy bin/hermes on LXC 129
  intentionally untouched (out of scope).

  Risk: N0 is identity-only rename; zero behavioral changes.
  Verification: go build ./... passes; docker compose --profile full
  resolves nomos service; grep -ri hermes (excluding archive/plans)
  returns only intentional refs (LLM model name, Matrix user).

README.md

@@ -1,8 +1,8 @@
 # Oikos
 
 Agentic homelab operating system written in Go. Single binary (`cmd/oikos`),
-Docker-deployed on mac-mini, with a standalone Hermes MCP agent gateway
-(`cmd/hermes`). Manages the **hubris** Proxmox homelab autonomously — observes
+Docker-deployed on mac-mini, with a standalone Nomos MCP agent gateway
+(`cmd/nomos`). Manages the **hubris** Proxmox homelab autonomously — observes
 state, classifies actions against policy, executes approved procedures over SSH,
 learns from outcomes, and escalates when uncertain.
 
@@ -16,7 +16,7 @@ learns from outcomes, and escalates when uncertain.
 # Dev stack (postgres + api + scheduler + notifier)
 docker compose --profile dev up -d
 
-# Full stack (adds Hermes agent gateway)
+# Full stack (adds Nomos agent gateway)
 docker compose --profile full up -d
 
 # Build standalone binary
@@ -33,7 +33,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
                   ┌──────────────────────────────────┐
                   │         mac-mini (Docker)         │
                   │                                   │
-  Workstation ─── │  hermes (8092) ──MCP── api (8090) │
+  Workstation ─── │  nomos (8092) ──MCP── api (8090) │
   (mesh)          │    MCP gateway      REST + MCP    │
                   │                                   │
                   │  scheduler ── notifier ── postgres │
@@ -46,7 +46,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
 | `oikos api` | 8090 | REST API + MCP server (15 tools) |
 | `oikos scheduler` | — | Probe runner, signal lifecycle, metrics |
 | `oikos notifier` | — | Approval tokens, Matrix alerts |
-| `hermes serve` | 8092 | MCP client gateway, query routing |
+| `nomos serve` | 8092 | MCP client gateway, query routing |
 
 ## Phases
 
@@ -55,7 +55,7 @@ OIKOS_DATABASE_URL="postgres://oikos:oikos_dev@localhost:5432/oikos?sslmode=disa
 | 1 — Ontology + DB | ✅ | TimescaleDB, migrations, seeds, blast_radius |
 | 2 — API | ✅ | OpenAPI-first REST + MCP, auth, SSE, audit |
 | 3 — Control loop | ✅ | Scheduler, actuator, learning, classifier, notifier |
-| 4 — Hermes agent | ✅ | Standalone MCP client gateway, agent activity |
+| 4 — Nomos agent | ✅ | Standalone MCP client gateway, agent activity |
 | 5 — Secrets | ✅ | Infisical backend + SOPS fallback, rotation runbooks |
 | 6 — Deploy | ✅ | CI pipeline, cutover checklist, watchdog, rollback |
 
@@ -71,7 +71,7 @@ curl http://localhost:8090/api/v1/health                  # fleet health
 curl http://localhost:8090/api/v1/agent-activity          # agent log
 ```
 
-### Hermes queries
+### Nomos queries
 
 ```bash
 # Structured tool call
@@ -101,7 +101,7 @@ oikos secret migrate  # SOPS → Infisical
 
 ```
 cmd/oikos/          Go entry point — single binary
-cmd/hermes/         Hermes MCP client gateway
+cmd/nomos/          Nomos MCP client gateway
 internal/           Go packages (httpapi, mcp, scheduler, actuator, learning,
                     notifier, policy, secrets, db, config, ontology, domain,
                     knowledge)
@@ -110,7 +110,7 @@ migrations/         Forward-only SQL migrations (TimescaleDB)
 seeds/              Bootstrap YAML (ontology, inventory, policy, knowledge)
 compose/            Dockerfiles + Caddy config
 scripts/            Deploy, watchdog, verification, rollback
-hermes/             Hermes config, persona, skills
+nomos/              Nomos config, persona, skills
 .agents/            Agent instruction files, shared conventions, skills
 archive/            Historical reference (legacy wiki, plans, SOPS backups)
 plans/              Design documents (active + done)