N0: rename Hermes → Nomos (standalone commit)

Problem: "Hermes" collides with Nous Researchs unrelated product;
  unclear identity for the resident agent.

  Change: Rename the live service identity across 39 files:
  - cmd/hermes/ → cmd/nomos/ (binary, env vars NOMOS_*)
  - internal/config/ server.go (NomosAgentSlug, nomosAgentID)
  - compose/hermes/ → compose/nomos/ (Dockerfile, service name)
  - hermes/ → nomos/ (SOUL.md, config.yaml, skills/)
  - .agents/HERMES.md → NOMOS.md (persona)
  - tools/setup-hermes-soul.sh → setup-nomos-soul.sh
  - seeds/inventory.yaml (agent:hermes → agent:nomos)
  - migrations/014_rename_agent_hermes_to_nomos.up.sql
  - Caddy vhost hermes.hubris.network → nomos.hubris.network
  - All referencing docs, scripts, ADR notes

  History preserved: archive/, plans/done/, ADRs not rewritten.
  Matrix @hermes notifier account and Legacy bin/hermes on LXC 129
  intentionally untouched (out of scope).

  Risk: N0 is identity-only rename; zero behavioral changes.
  Verification: go build ./... passes; docker compose --profile full
  resolves nomos service; grep -ri hermes (excluding archive/plans)
  returns only intentional refs (LLM model name, Matrix user).

bootstrap.sh

@@ -3,7 +3,7 @@
 #
 # Thin client model (rev 2): no git clone, no sync timer. Fetches only the
 # agent orientation files (CLIENTS.md, AGENTS.md, OIKOS.md) and tooling
-# (caveman, hermes-soul) from the raw Gitea URL. Enrolls via the Oikos API
+# (caveman, nomos-soul) from the raw Gitea URL. Enrolls via the Oikos API
 # to receive an age keypair and Infisical machine identity. A lightweight
 # context poller replaces the old 5-minute git pull.
 #
@@ -11,7 +11,7 @@
 #   curl -fsSL https://git.hubris.network/dtoro/oikos/raw/main/bootstrap.sh \
 #     | sudo bash
 #   curl ... | sudo bash -s -- --with-mcp           # wire Claude's .mcp.json
-#   curl ... | sudo bash -s -- --with-hermes        # install Goose + Hermes
+#   curl ... | sudo bash -s -- --with-nomos        # install Goose + Nomos
 #   curl ... | sudo bash -s -- --dry-run            # show what would happen
 #
 # Prerequisites:
@@ -28,11 +28,11 @@ REPO_RAW_URL="${HOMELAB_RAW_URL:-https://git.hubris.network/dtoro/oikos/raw/main
 OIKOS_API_URL="${HOMELAB_OIKOS_URL:-https://oikos.hubris.network/api/v1}"
 CLONE_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab}"
 MCP_URL="${HOMELAB_MCP_URL:-https://mcp.hubris.network/mcp}"
-HERMES_MCP_URI="${HOMELAB_HERMES_MCP_URI:-https://mcp.hubris.network/mcp}"
-HERMES_MODEL="${HOMELAB_HERMES_MODEL:-nousresearch/hermes-4-405b}"
+NOMOS_MCP_URI="${HOMELAB_NOMOS_MCP_URI:-https://mcp.hubris.network/mcp}"
+NOMOS_MODEL="${HOMELAB_NOMOS_MODEL:-nousresearch/hermes-4-405b}"
 
 WITH_MCP=0
-WITH_HERMES=0
+WITH_NOMOS=0
 DRY_RUN=0
 
 GITEA_TOKEN="${HOMELAB_GITEA_TOKEN:-}"
@@ -79,7 +79,7 @@ detect_mesh_ip() {
 while [ $# -gt 0 ]; do
     case "$1" in
         --with-mcp)       WITH_MCP=1 ;;
-        --with-hermes)    WITH_HERMES=1 ;;
+        --with-nomos)    WITH_NOMOS=1 ;;
         --dry-run)        DRY_RUN=1 ;;
         --gitea-token)    GITEA_TOKEN="$2"; shift ;;
         --gitea-user)     GITEA_USER="$2"; shift ;;
@@ -148,7 +148,7 @@ done
 
 # ── fetch tools ──────────────────────────────────────────────────────
 log "fetching tools..."
-for tool in setup-caveman.sh setup-hermes-soul.sh caveman.js caveman_wrapper.sh post-pull.sh; do
+for tool in setup-caveman.sh setup-nomos-soul.sh caveman.js caveman_wrapper.sh post-pull.sh; do
     url="$REPO_RAW_URL/tools/${tool}"
     dest="$CLONE_DIR/tools/${tool}"
     dry mkdir -p "$(dirname "$dest")"
@@ -319,15 +319,15 @@ if [ "$WITH_MCP" -eq 1 ]; then
     log "  + MCP wired to $MCP_URL"
 fi
 
-# ── --with-hermes: install Goose + Hermes wrapper ────────────────────
-if [ "$WITH_HERMES" -eq 1 ]; then
-    log "installing Hermes agent..."
+# ── --with-nomos: install Goose + Nomos wrapper ────────────────────
+if [ "$WITH_NOMOS" -eq 1 ]; then
+    log "installing Nomos agent..."
     GOOSE_URL="https://github.com/block/goose/releases/latest/download/goose-${OS}-${ARCH:-amd64}"
     if [ "$OS" = Darwin ]; then GOOSE_URL="https://github.com/block/goose/releases/latest/download/goose-darwin-${ARCH:-arm64}"; fi
     dry curl -fsSL "$GOOSE_URL" -o /usr/local/bin/goose 2>/dev/null && chmod +x /usr/local/bin/goose || warn "goose not installed"
-    # Drop Hermes persona
-    cp "$CLONE_DIR/HERMES.md" "$CLONE_DIR/.agents/HERMES.md" 2>/dev/null || true
-    log "  + Hermes agent installed"
+    # Drop Nomos persona
+    cp "$CLONE_DIR/NOMOS.md" "$CLONE_DIR/.agents/NOMOS.md" 2>/dev/null || true
+    log "  + Nomos agent installed"
 fi
 
 # ── netbird SSH JWT cache ────────────────────────────────────────────