fix(mibook): disable hermes-agent's built-in self-update GitHub polling

Its self-updater was independently polling GitHub for the same repo the
flake input tracks, and stacked with a runaway crash-restart loop this
exhausted the GitHub rate limit, causing unrelated flake fetches to 429.
The Nix flake input is already the source of truth for hermes's version.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F9ge2kVMD55sLJExx3v2G3

machines/mibook/network.nix

@@ -4,5 +4,6 @@ _: {
   # firewall otherwise blocks inbound connections from other devices.
   networking.firewall.allowedTCPPorts = [
     9119 # athena hermes dashboard
+    47823 # hermes agent ad-hoc webpage server
   ];
 }

modules/environments/hermes-agent/default.nix

@@ -20,6 +20,9 @@ in
       enable = true;
       # Deliberate pin, matches the approved design — bump on purpose, not by drift.
       settings.model.default = "anthropic/claude-sonnet-4-5";
+      # The Nix flake input is the source of truth for hermes's version here; its
+      # built-in self-updater polling GitHub independently just burns API quota.
+      settings.updates.check = false;
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;