feat(mibook): add Hermes Agent profile module

machines/configuration.nix

@@ -5,6 +5,7 @@ let
     nixpkgs-unstable
     nixos-hardware
     sops-nix
+    hermes-agent
     #hyprland
     ;
   nixosSystem = nixpkgs.lib.makeOverridable nixpkgs.lib.nixosSystem;
@@ -62,6 +63,7 @@ in
       specialArgs = { inherit self; };
       modules = defaultModules ++ [
         # nixos-hardware.nixosModules.mibook
+        hermes-agent.nixosModules.default
         ./mibook/configuration.nix
       ];
     };

machines/mibook/environments.nix

@@ -10,6 +10,7 @@ _: {
     development.enable = true;
     docker.enable = true;
     claude-code.enable = true;
+    hermes-agent.enable = true;
   };
 
   my.hardware = {

machines/mibook/secrets.nix

@@ -2,11 +2,10 @@
 # via machines/core/sops.nix.
 { ... }:
 {
-  # Pipeline smoke test — proves host-key decryption works end to end.
-  # Safe to delete once a real secret is in place.
-  sops.secrets.placeholder = {
+  sops.secrets.hermes-env = {
+    owner = "hermes";
+    group = "hermes";
     mode = "0400";
-    owner = "root";
-    group = "root";
+    restartUnits = [ "hermes-agent.service" ]; # confirmed/fixed in Task 4 if the unit name differs
   };
 }