feat: persist OS-level cron jobs on Railway via supercronic

[tomfuertes]

Closes #10.

Summary

• Install supercronic v0.2.45 in the Dockerfile (sha256-pinned, arm64 + amd64).
• start.sh now sources /data/.hermes/.env, ensures /data/crontab exists, and launches supercronic -passthrough-logs /data/crontab as a background sibling of the Hermes gateway.
• README gains a Cron Jobs section with the format, a worked end-to-end example (CI-status-flip → Slack webhook, zero LLM tokens), and a note clarifying when to use OS-level cron vs Hermes' own /data/.hermes/cron/ agent scheduler.

Why this shape

• /data is the only path that survives Railway redeploys, so the crontab itself has to live there. Putting the file at /data/crontab keeps it separate from the Hermes-managed /data/.hermes/cron/ agent jobs — clean ownership boundary.
• Stock cron/crond daemonizes itself, drops parent env, and writes through syslog — none of which composes with tini as PID 1 or Railway's stdout-based log pipeline. supercronic is a single static Go binary that runs in the foreground, inherits env, and prints to stdout.
• set -a; . /data/.hermes/.env; set +a before launching supercronic lets cron entries reference the same secrets the gateway uses (SHIBARI_GITHUB_READONLY, SLACK_WEBHOOK_URL, etc.) without manual re-export.
• tini -g (already in the ENTRYPOINT) signals the whole process group, so Railway's SIGTERM on redeploy reaches both supercronic and the gateway.

Test plan

• docker build -t hermes-agent . succeeds on amd64
• Container boots cleanly with empty /data/crontab (no errors in logs)
• Add a * * * * * date line to /data/crontab, restart, verify per-minute output appears in Railway logs with [supercronic] prefix
• Add a job that uses an env var from /data/.hermes/.env, verify the var is visible
• Redeploy the service, confirm /data/crontab is preserved and jobs resume on the next tick
• (Optional) drop in the README's check-ci.sh example, force a CI failure, confirm exactly one Slack notification fires

[tomfuertes]

Superseded by NousResearch/hermes-agent#19709 — Hermes' built-in cron now supports no_agent=True for shell-script schedules with no LLM invocation, which covers the zero-token-cron use case directly. Adding supercronic at the template layer is redundant. Follow-up: bump HERMES_REF so Railway builds pick up the upstream feature.