feat(nix): container-aware CLI — auto-route hermes chat into managed container

[Master-Rensei]

Summary

When container.enable = true in the NixOS module, running hermes chat on the host now automatically execs into the managed container via docker/podman exec. The interactive CLI runs in the same environment as the gateway service — with access to all container-installed packages and tools.

Previously, users had to manually run:

sudo podman exec -it hermes-agent sh -lc '/data/current-package/bin/hermes chat'

Now they just run:

hermes chat

How it works

1. NixOS activation script writes a .container-mode metadata file to HERMES_HOME containing backend, container_name, and hermes_bin. File is removed when container mode is disabled.

2. Host CLI detection (hermes_cli/config.py):

   • _is_inside_container() — detects /.dockerenv, /run/.containerenv, and cgroup markers to prevent infinite exec loops
   • get_container_exec_info() — reads .container-mode, returns None if already inside a container or file doesn't exist

3. Container exec (hermes_cli/main.py):

   • _exec_in_container() validates the container runtime exists and is running, then os.execvp() replaces the process
   • cmd_chat intercepts before normal flow to check for container routing

Safety & fallback

• --host flag bypasses container routing
• Falls back to host CLI if: container runtime not found, container not running, inspect fails, or any detection error
• Already-inside-container detection prevents infinite exec loops
• --host is stripped from forwarded args (not meaningful inside container)

Files changed

File	Change
hermes_cli/config.py	_is_inside_container(), get_container_exec_info()
hermes_cli/main.py	_exec_in_container(), --host flag, cmd_chat intercept
nix/nixosModules.nix	Write/remove .container-mode in activation script
tests/hermes_cli/test_container_aware_cli.py	14 tests
website/docs/getting-started/nix-setup.md	Container-aware CLI docs

Test plan

• 14 unit tests pass (detection, metadata parsing, exec building, fallbacks)
• Manual test on NixOS with container.enable = true + addToSystemPackages = true
• Verify --host bypasses container routing
• Verify fallback when container is stopped

Closes #7380

---

Reopens closed PR #7470 (by @alt-glitch) from fork Master-Rensei/hermes-agent

[alt-glitch]

Duplicate of #7543 (already merged). This PR reopens a previously closed fork branch, but the feature (container-aware CLI) was already landed via a salvage PR.