phase 4: hermes agent — MCP tools, activity logging, 'all' role, wiring fixes

- mcp/server.go: 7 new tools (get_signal_history, get_patterns, get_skills,
  request_execution, get_trend, get_event_timeline, get_agent_activity),
  agent_activity logging middleware on every tool call.
- phase3.go: QueryAgentActivity REST handler implemented (was stub).
  Fixed scan count mismatch in ListSkills/PatchSkill/ListSkillVersions
  (13 cols → 12 targets). Fixed AgentActivity cursor pagination
  (lexicographic → integer comparison). Fixed s.Slug → s.Name in log.
- cmd/oikos/main.go: 'all' role now runs api + scheduler + notifier in
  one process. Replaced nil SchedulerRunner/NotifierRunner with direct
  scheduler.RunnerForMain() / notifier.RunnerForMain() imports.
  Added runWithPool helper for standalone scheduler/notifier roles.
- internal/config/config.go: added HermesAgentID env var.
- internal/httpapi/server.go: pass HermesAgentID to MCP handler.
- docker-compose.yml: added scheduler and notifier services (dev profile).
- hermes/: config.yaml, SOUL.md, skills/homelab-ops/SKILL.md.
- Cleaned up: scheduler/init.go dead code, mcp/server.go pgx import guard.

docker-compose.yml

@@ -60,11 +60,46 @@ services:
       OIKOS_API_LISTEN: ":8090"
       OIKOS_ENV: dev
       OIKOS_DEBUG: "true"
+      OIKOS_HERMES_AGENT_ID: ${OIKOS_HERMES_AGENT_ID:-}
     ports:
       - "8090:8090"
     command: ["api"]
     stop_signal: SIGTERM
     stop_grace_period: 30s
 
+  # Scheduler (Phase 3) — observe loop
+  scheduler:
+    build:
+      context: .
+      dockerfile: compose/oikos/Dockerfile
+    profiles: ["dev", "full"]
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+    environment:
+      OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
+      OIKOS_DEBUG: "true"
+      OIKOS_SCHEDULER_INTERVAL: "30s"
+    command: ["scheduler"]
+    stop_signal: SIGTERM
+    stop_grace_period: 30s
+
+  # Notifier (Phase 3) — Matrix alerts
+  notifier:
+    build:
+      context: .
+      dockerfile: compose/oikos/Dockerfile
+    profiles: ["dev", "full"]
+    depends_on:
+      seed:
+        condition: service_completed_successfully
+    environment:
+      OIKOS_DATABASE_URL: postgres://oikos:${OIKOS_DB_PASSWORD:-oikos_dev}@postgres:5432/oikos?sslmode=disable
+      OIKOS_DEBUG: "true"
+      OIKOS_APPROVAL_HMAC_SECRET: ${OIKOS_APPROVAL_HMAC_SECRET:-dev-secret}
+    command: ["notifier"]
+    stop_signal: SIGTERM
+    stop_grace_period: 30s
+
 volumes:
   pg-data: