phase 4: hermes agent — MCP tools, activity logging, 'all' role, wiring fixes

- mcp/server.go: 7 new tools (get_signal_history, get_patterns, get_skills,
  request_execution, get_trend, get_event_timeline, get_agent_activity),
  agent_activity logging middleware on every tool call.
- phase3.go: QueryAgentActivity REST handler implemented (was stub).
  Fixed scan count mismatch in ListSkills/PatchSkill/ListSkillVersions
  (13 cols → 12 targets). Fixed AgentActivity cursor pagination
  (lexicographic → integer comparison). Fixed s.Slug → s.Name in log.
- cmd/oikos/main.go: 'all' role now runs api + scheduler + notifier in
  one process. Replaced nil SchedulerRunner/NotifierRunner with direct
  scheduler.RunnerForMain() / notifier.RunnerForMain() imports.
  Added runWithPool helper for standalone scheduler/notifier roles.
- internal/config/config.go: added HermesAgentID env var.
- internal/httpapi/server.go: pass HermesAgentID to MCP handler.
- docker-compose.yml: added scheduler and notifier services (dev profile).
- hermes/: config.yaml, SOUL.md, skills/homelab-ops/SKILL.md.
- Cleaned up: scheduler/init.go dead code, mcp/server.go pgx import guard.

hermes/config.yaml

@@ -0,0 +1,26 @@
+# Hermes container config — Gateway mode with MCP wiring (Phase 4)
+# Deployed: mac-mini Docker, mesh-published :8092
+# No SSH keys in this container; all mutations route through /executions
+
+agent:
+  name: hermes
+  entity_slug: agent:hermes
+  role: gateway
+
+mcp:
+  endpoint: http://api:8090/mcp
+  transport: streamable_http
+  bearer_token_env: OIKOS_MCP_BEARER_TOKEN
+
+server:
+  listen: ":8092"
+  mesh_only: true
+
+model:
+  provider: openrouter
+  model: deepseek/deepseek-v4-pro
+  api_key_env: OPENROUTER_API_KEY
+
+session:
+  mode: smart_approve
+  skills_dir: /app/hermes/skills