hermes: CDP browser daemon + MCP client wiring for the agent

Adds a digest-pinned headless-shell Chrome DevTools Protocol daemon as a
boot-persistent quadlet unit (chrome-devtools-protocol.container). The
entrypoint override drops the image's socat front so the CDP endpoint binds
loopback-only on 127.0.0.1:9222 in the host network namespace; only the two
host-network consumers (Signal gateway, webui server) can drive it.

hermes-webui flips Network=dankclaw_default -> Network=host so its agent
process shares the daemon's namespace (0.0.0.0:8787 bind is LAN-facing as
before; no exposure change). deploy_hermes installs the new unit and starts
it if inactive without restarting in-flight browser sessions.

scripts/deploy-remote.sh

@@ -576,6 +576,15 @@ deploy_hermes() {
     # cannot be enabled by this host's v1 quadlet generator).
     local unit
     mkdir -p "$quadlet_unit_dir"
+    # The CDP browser daemon is a companion service to the trio: install its
+    # unit and start it if inactive, but never restart it on deploy — a
+    # restart would kill in-flight browser sessions. Consumers (gateway,
+    # webui) reconnect with backoff.
+    cp "dankclaw/hermes/quadlet/chrome-devtools-protocol.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active --quiet chrome-devtools-protocol.service; then
+        systemctl --user start chrome-devtools-protocol.service
+    fi
     # The units run the image under a localhost/-aliased tag: this host's
     # quadlet path can fail to resolve registry-prefixed refs from local
     # storage at create time. Tag first, then (re)create via deploy.
@@ -583,7 +592,6 @@ deploy_hermes() {
     for unit in hermes hermes-dashboard hermes-webui; do
         cp "dankclaw/hermes/quadlet/$unit.container" "$quadlet_unit_dir/"
     done
-    systemctl --user daemon-reload
     if ! systemctl --user is-active --quiet hermes.service; then
         podman stop hermes hermes-dashboard hermes-webui 2>/dev/null || true
         podman rm hermes hermes-dashboard hermes-webui 2>/dev/null || true