N0: rename Hermes → Nomos (standalone commit)

Problem: "Hermes" collides with Nous Researchs unrelated product;
  unclear identity for the resident agent.

  Change: Rename the live service identity across 39 files:
  - cmd/hermes/ → cmd/nomos/ (binary, env vars NOMOS_*)
  - internal/config/ server.go (NomosAgentSlug, nomosAgentID)
  - compose/hermes/ → compose/nomos/ (Dockerfile, service name)
  - hermes/ → nomos/ (SOUL.md, config.yaml, skills/)
  - .agents/HERMES.md → NOMOS.md (persona)
  - tools/setup-hermes-soul.sh → setup-nomos-soul.sh
  - seeds/inventory.yaml (agent:hermes → agent:nomos)
  - migrations/014_rename_agent_hermes_to_nomos.up.sql
  - Caddy vhost hermes.hubris.network → nomos.hubris.network
  - All referencing docs, scripts, ADR notes

  History preserved: archive/, plans/done/, ADRs not rewritten.
  Matrix @hermes notifier account and Legacy bin/hermes on LXC 129
  intentionally untouched (out of scope).

  Risk: N0 is identity-only rename; zero behavioral changes.
  Verification: go build ./... passes; docker compose --profile full
  resolves nomos service; grep -ri hermes (excluding archive/plans)
  returns only intentional refs (LLM model name, Matrix user).

compose/caddy/Caddyfile.oikos

@@ -17,12 +17,12 @@ oikos.hubris.network {
     }
 }
 
-# Oikos MCP endpoint (Hermes agents) — no auth required
+# Oikos MCP endpoint (agents) — no auth required
 mcp.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8090
 }
 
-# Hermes gateway (workstation access)
-hermes.hubris.network {
+# Nomos gateway (workstation access) — formerly hermes.hubris.network
+nomos.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8092
 }

compose/hermes/Dockerfile

@@ -1,25 +0,0 @@
-# Hermes agent container — standalone MCP client gateway (Phase 4)
-FROM golang:1.26-alpine AS builder
-
-RUN apk add --no-cache git ca-certificates
-
-WORKDIR /build
-COPY go.mod go.sum ./
-RUN go mod download
-
-COPY . .
-
-RUN CGO_ENABLED=0 go build -o /hermes -tags timetzdata -ldflags="-s -w" ./cmd/hermes
-
-FROM gcr.io/distroless/static:nonroot
-
-COPY --from=builder /hermes /hermes
-COPY hermes/ /app/hermes/
-
-ENV HERMES_MCP_URL=http://api:8090/mcp
-ENV HERMES_AGENT_SLUG=agent:hermes
-ENV HERMES_LISTEN=:8092
-
-EXPOSE 8092
-
-ENTRYPOINT ["/hermes", "serve"]

compose/nomos/Dockerfile

@@ -0,0 +1,25 @@
+# Nomos agent container — standalone MCP client gateway (Phase 4)
+FROM golang:1.26-alpine AS builder
+
+RUN apk add --no-cache git ca-certificates
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 go build -o /nomos -tags timetzdata -ldflags="-s -w" ./cmd/nomos
+
+FROM gcr.io/distroless/static:nonroot
+
+COPY --from=builder /nomos /nomos
+COPY nomos/ /app/nomos/
+
+ENV NOMOS_MCP_URL=http://api:8090/mcp
+ENV NOMOS_AGENT_SLUG=agent:nomos
+ENV NOMOS_LISTEN=:8092
+
+EXPOSE 8092
+
+ENTRYPOINT ["/nomos", "serve"]