fix(mibook): disable hermes-agent's built-in self-update GitHub polling

Its self-updater was independently polling GitHub for the same repo the
flake input tracks, and stacked with a runaway crash-restart loop this
exhausted the GitHub rate limit, causing unrelated flake fetches to 429.
The Nix flake input is already the source of truth for hermes's version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3

modules/environments/hermes-agent/default.nix

@@ -20,6 +20,9 @@ in
       enable = true;
       # Deliberate pin, matches the approved design — bump on purpose, not by drift.
       settings.model.default = "anthropic/claude-sonnet-4-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;