N0: rename Hermes → Nomos (standalone commit)

Problem: "Hermes" collides with Nous Researchs unrelated product;
  unclear identity for the resident agent.

  Change: Rename the live service identity across 39 files:
  - cmd/hermes/ → cmd/nomos/ (binary, env vars NOMOS_*)
  - internal/config/ server.go (NomosAgentSlug, nomosAgentID)
  - compose/hermes/ → compose/nomos/ (Dockerfile, service name)
  - hermes/ → nomos/ (SOUL.md, config.yaml, skills/)
  - .agents/HERMES.md → NOMOS.md (persona)
  - tools/setup-hermes-soul.sh → setup-nomos-soul.sh
  - seeds/inventory.yaml (agent:hermes → agent:nomos)
  - migrations/014_rename_agent_hermes_to_nomos.up.sql
  - Caddy vhost hermes.hubris.network → nomos.hubris.network
  - All referencing docs, scripts, ADR notes

  History preserved: archive/, plans/done/, ADRs not rewritten.
  Matrix @hermes notifier account and Legacy bin/hermes on LXC 129
  intentionally untouched (out of scope).

  Risk: N0 is identity-only rename; zero behavioral changes.
  Verification: go build ./... passes; docker compose --profile full
  resolves nomos service; grep -ri hermes (excluding archive/plans)
  returns only intentional refs (LLM model name, Matrix user).

docker-compose.yml

@@ -60,7 +60,7 @@ services:
       OIKOS_API_LISTEN: ":8090"
       OIKOS_ENV: dev
       OIKOS_DEBUG: "true"
-      OIKOS_HERMES_AGENT_SLUG: ${OIKOS_HERMES_AGENT_SLUG:-agent:hermes}
+      OIKOS_NOMOS_AGENT_SLUG: ${OIKOS_NOMOS_AGENT_SLUG:-agent:nomos}
     volumes:
       - ${OIKOS_SSH_KEY_PATH:-~/.ssh/id_ed25519}:/etc/oikos/ssh_key:ro
     ports:
@@ -107,18 +107,18 @@ services:
     stop_signal: SIGTERM
     stop_grace_period: 30s
 
-  # Hermes agent gateway (Phase 4) — mesh-published :8092
-  hermes:
+  # Nomos agent gateway (Phase 4) — mesh-published :8092
+  nomos:
     build:
       context: .
-      dockerfile: compose/hermes/Dockerfile
+      dockerfile: compose/nomos/Dockerfile
     profiles: ["full"]
     depends_on:
       api:
         condition: service_started
     environment:
-      HERMES_MCP_URL: http://api:8090/mcp
-      HERMES_AGENT_SLUG: agent:hermes
+      NOMOS_MCP_URL: http://api:8090/mcp
+      NOMOS_AGENT_SLUG: agent:nomos
     ports:
       - "8092:8092"
     stop_signal: SIGTERM