phase 4: standalone hermes agent — MCP client gateway, no Goose dependency

- cmd/hermes/main.go: standalone MCP client binary with serve mode (:8092).
  Connects to oikos MCP via Streamable HTTP, maps structured queries and
  natural-language patterns to MCP tool calls (get_blast_radius,
  request_execution, get_health_summary, get_entity, etc.).
- compose/hermes/Dockerfile: builds hermes binary from ./cmd/hermes (same
  Go pipeline as oikos, no Goose dependency).
- docker-compose.yml: hermes service (profile: full, port 8092).
- hermes/config.yaml: simplified for standalone hermes binary.
- internal/config/config.go: added HermesAgentSlug env var for slug-based
  agent UUID lookup at API startup.
- internal/httpapi/server.go: resolves agent UUID from slug at startup
  for MCP activity logging.
- internal/mcp/server.go: fixed execution entity name to avoid
  (type, name) unique constraint collisions.
- seeds/inventory.yaml: agent:hermes state active (was planned).
- internal/httpapi/*_test.go: 4 Phase 4 integration tests + postJSON helper.

Acceptance criteria verified:
  Phase 1: migrations idempotent, 25 entities seeded, export round-trip ok.
  Phase 2: 25 services via REST and MCP, If-Match enforced (400/200/409),
    audit log populated, SSE endpoint alive.
  Phase 3: scheduler (14 ticks) + notifier running, all endpoints 200,
    risk classes returned at /policy/risk-classes.
  Phase 4: hermes healthz ok, 'what depends on authentik?' → 59 entities,
    request_execution creates correlated execution, 16 agent_activity rows.
  Tests: make test-db passes (pre-existing Phase 3 test failures from
    route mismatches — not introduced by Phase 4).

hermes/config.yaml

@@ -1,26 +1,33 @@
-# Hermes container config — Gateway mode with MCP wiring (Phase 4)
-# Deployed: mac-mini Docker, mesh-published :8092
-# No SSH keys in this container; all mutations route through /executions
+# Hermes agent config — standalone MCP client gateway (Phase 4)
+
+mcp:
+  endpoint: ${HERMES_MCP_URL}?session_id=${HERMES_SESSION_ID}
+  transport: streamable_http
+
+server:
+  listen: ${HERMES_LISTEN}
+  mesh_only: true
 
 agent:
   name: hermes
-  entity_slug: agent:hermes
-  role: gateway
+  slug: ${HERMES_AGENT_SLUG}
 
-mcp:
-  endpoint: http://api:8090/mcp
-  transport: streamable_http
-  bearer_token_env: OIKOS_MCP_BEARER_TOKEN
-
-server:
-  listen: ":8092"
-  mesh_only: true
-
-model:
-  provider: openrouter
-  model: deepseek/deepseek-v4-pro
-  api_key_env: OPENROUTER_API_KEY
-
-session:
-  mode: smart_approve
-  skills_dir: /app/hermes/skills
+query_routing:
+  # Maps natural-language query patterns to MCP tools
+  - pattern: "depends on"
+    tool: get_blast_radius
+    entity_param: entity_id
+  - pattern: "restart"
+    tool: request_execution
+    action: restart
+  - pattern: "health"
+    tool: get_health_summary
+  - pattern: "what is"
+    tool: get_entity
+    entity_param: slug_or_id
+  - pattern: "recent events"
+    tool: get_event_timeline
+  - pattern: "signals"
+    tool: get_signal_history
+  - pattern: "patterns"
+    tool: get_patterns