fix(mibook): import hermes-agent module from the profile, not machines/configuration.nix

machines/configuration.nix wired hermes-agent.nixosModules.default into
mibook's mibook-only modules list. modules/environments/default.nix is
machine-agnostic, so jupiter still evaluated a
services.hermes-agent = lib.mkIf false { ... } definition for an option it
never declared as existing — NixOS errors on that regardless of mkIf's
condition, breaking nixosConfigurations.jupiter (and the repo's sole CI
job) entirely.

Fix: import the upstream module unconditionally from inside
modules/environments/hermes-agent/default.nix itself, so the option is
declared everywhere modules/environments/default.nix loads, and only ever
turned on where my.profiles.hermes-agent.enable = true (mibook). Also adds
users.users.finn.extraGroups = [ "hermes" ], required for the hermes CLI to
be usable per the corrected design. machines/configuration.nix no longer
mentions hermes-agent.

Deviates from the reconciled spec/plan text in one respect: uses `self`
(from specialArgs) instead of `inputs` (from _module.args) to reach the
flake input inside `imports`. Using `inputs` there reproduced infinite
recursion — NixOS resolves a module's imports before _module.args
assignments are merged, so an import list cannot depend on an arg that
itself comes from config. `self` is available at import-time via
specialArgs, `inputs` is not, in this repo's wiring. See report for detail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

machines/configuration.nix

@@ -5,7 +5,6 @@ let
     nixpkgs-unstable
     nixos-hardware
     sops-nix
-    hermes-agent
     #hyprland
     ;
   nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
@@ -63,7 +62,6 @@ in
       specialArgs = { inherit self; };
       modules = defaultModules ++ [
         # nixos-hardware.nixosModules.mibook
-        hermes-agent.nixosModules.default
         ./mibook/configuration.nix
       ];
     };