N0: rename Hermes → Nomos (standalone commit)

Problem: "Hermes" collides with Nous Researchs unrelated product;
  unclear identity for the resident agent.

  Change: Rename the live service identity across 39 files:
  - cmd/hermes/ → cmd/nomos/ (binary, env vars NOMOS_*)
  - internal/config/ server.go (NomosAgentSlug, nomosAgentID)
  - compose/hermes/ → compose/nomos/ (Dockerfile, service name)
  - hermes/ → nomos/ (SOUL.md, config.yaml, skills/)
  - .agents/HERMES.md → NOMOS.md (persona)
  - tools/setup-hermes-soul.sh → setup-nomos-soul.sh
  - seeds/inventory.yaml (agent:hermes → agent:nomos)
  - migrations/014_rename_agent_hermes_to_nomos.up.sql
  - Caddy vhost hermes.hubris.network → nomos.hubris.network
  - All referencing docs, scripts, ADR notes

  History preserved: archive/, plans/done/, ADRs not rewritten.
  Matrix @hermes notifier account and Legacy bin/hermes on LXC 129
  intentionally untouched (out of scope).

  Risk: N0 is identity-only rename; zero behavioral changes.
  Verification: go build ./... passes; docker compose --profile full
  resolves nomos service; grep -ri hermes (excluding archive/plans)
  returns only intentional refs (LLM model name, Matrix user).

scripts/cutover-checklist.md

@@ -6,7 +6,7 @@ Status: [x] = done, [ ] = pending
 
 - [x] **Backup**: `pg_dump oikos > backups/pre-cutover-20260707.sql` (145K)
 - [x] **CI green**: pushed to main, `.gitea/workflows/ci.yml` exists
-- [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
+- [x] **Deploy test**: Docker stack running with api + scheduler + notifier + nomos
 - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
 - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
 - [x] **Secrets**: Infisical bootstrapped + migration complete 2026-07-07. All 11 SOPS secrets migrated to Infisical (oikos project, dev env). Machine identity `oikos-api` has RW access verified via Go SDK. ENCRYPTION_KEY must be 32-char raw string (docs incorrect). SOPS fallback preserved for DR. secrets-issuance decommissioned — stopped/disabled on apps/105; superseded by Infisical.
@@ -23,7 +23,7 @@ Status: [x] = done, [ ] = pending
 ## Post-cutover verification
 
 - [x] **./scripts/verify-phase6.sh** — all 14 checks pass
-- [x] **Hermes query**: `curl http://localhost:8092/query -d '{"query":"fleet health"}'` → HTTP 200
+- [x] **Nomos query**: `curl http://localhost:8092/query -d '{"query":"fleet health"}'` → HTTP 200
 - [x] **Agent activity**: `curl http://localhost:8090/api/v1/agent-activity` → returns data
 - [x] **Scheduler ticking**: 30s ticks logged
 - [x] **Notifier polling**: running

scripts/verify-phase6.sh

@@ -27,7 +27,7 @@ check "4. Scheduler: check pass"             "http://localhost:8090/api/v1/check
 check "5. Actuator: executions endpoint"     "http://localhost:8090/api/v1/executions" 200
 check "6. Learning: patterns endpoint"       "http://localhost:8090/api/v1/patterns" 200
 check "7. Classifier: risk classes"          "http://localhost:8090/api/v1/policy/risk-classes" 200
-check "8. Hermes: gateway health"            "http://localhost:8092/healthz" 200
+check "8. Nomos: gateway health"            "http://localhost:8092/healthz" 200
 check "9. Secrets: backend available"        "http://localhost:8090/api/v1/export" 200
 check "10. Deploy: events endpoint"          "http://localhost:8090/api/v1/events" 200
 check "11. Knowledge: content search"        "http://localhost:8090/healthz" 200