fix(mibook): import hermes-agent module from the profile, not machines/configuration.nix

machines/configuration.nix wired hermes-agent.nixosModules.default into
mibook's mibook-only modules list. modules/environments/default.nix is
machine-agnostic, so jupiter still evaluated a
services.hermes-agent = lib.mkIf false { ... } definition for an option it
never declared as existing — NixOS errors on that regardless of mkIf's
condition, breaking nixosConfigurations.jupiter (and the repo's sole CI
job) entirely.

Fix: import the upstream module unconditionally from inside
modules/environments/hermes-agent/default.nix itself, so the option is
declared everywhere modules/environments/default.nix loads, and only ever
turned on where my.profiles.hermes-agent.enable = true (mibook). Also adds
users.users.finn.extraGroups = [ "hermes" ], required for the hermes CLI to
be usable per the corrected design. machines/configuration.nix no longer
mentions hermes-agent.

Deviates from the reconciled spec/plan text in one respect: uses `self`
(from specialArgs) instead of `inputs` (from _module.args) to reach the
flake input inside `imports`. Using `inputs` there reproduced infinite
recursion — NixOS resolves a module's imports before _module.args
assignments are merged, so an import list cannot depend on an arg that
itself comes from config. `self` is available at import-time via
specialArgs, `inputs` is not, in this repo's wiring. See report for detail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

machines/configuration.nix

@@ -5,7 +5,6 @@ let
     nixpkgs-unstable
     nixos-hardware
     sops-nix
-    hermes-agent
     #hyprland
     ;
   nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
@@ -63,7 +62,6 @@ in
       specialArgs = { inherit self; };
       modules = defaultModules ++ [
         # nixos-hardware.nixosModules.mibook
-        hermes-agent.nixosModules.default
         ./mibook/configuration.nix
       ];
     };

modules/environments/hermes-agent/default.nix

@@ -3,21 +3,31 @@
   config,
   lib,
   pkgs,
+  self,
   ...
 }:
 let
   cfg = config.my.profiles.hermes-agent;
 in
 {
+  imports = [ self.inputs.hermes-agent.nixosModules.default ];
+
   options.my.profiles.hermes-agent.enable =
     lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";
 
   config = lib.mkIf cfg.enable {
     services.hermes-agent = {
       enable = true;
+      # Deliberate pin, matches the approved design — bump on purpose, not by drift.
       settings.model.default = "anthropic/claude-sonnet-4-5";
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
     };
+
+    # addToSystemPackages only puts `hermes` on $PATH; using it needs group
+    # access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
+    # this machine's one human user and already knows hermes-env's contents
+    # (typed them into sops directly), so this is not new exposure.
+    users.users.finn.extraGroups = [ "hermes" ];
   };
 }