feat(hermes-triage): real-repo patch proposals + Alertmanager email escalation

- Ariadne: per-repo code config for metis, lesavka, soteria,
  bstein-dev-home and ariadne, each with its own base branch, source path
  prefixes and file suffixes so a proposal can only touch that repo's
  source tree
- Alertmanager: the only receiver was an empty "default", so every alert
  fired into a void. HermesTriageHumanRequired now routes to an email
  receiver via Mailu's in-cluster local-domain relay, with resolved
  notices; scoped to service=hermes-triage so nothing else mails yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/maintenance/apps/ariadne-deployment.yaml

@@ -515,6 +515,19 @@ spec:
               value: classification
             - name: ARIADNE_HERMES_ISSUE_MAX_PER_TICK
               value: "2"
+            # Homegrown repositories that may receive a Hermes patch proposal.
+            # Escalated incidents on these jobs get an issue AND, when the
+            # evidence implicates source files, a pull request on a
+            # hermes-repair/<build> branch. Path allowlists are per repo so a
+            # proposal can only ever touch that repo's source tree.
+            - name: ARIADNE_HERMES_CODE_REPOS
+              value: metis=bstein/metis,lesavka=bstein/lesavka,soteria=bstein/soteria,bstein-dev-home=bstein/bstein-dev-home,ariadne=bstein/ariadne
+            - name: ARIADNE_HERMES_CODE_BASE_BRANCHES
+              value: metis=master,lesavka=master,soteria=main,bstein-dev-home=master,ariadne=master
+            - name: ARIADNE_HERMES_CODE_PREFIXES
+              value: metis=cmd/|pkg/,lesavka=server/|client/|common/,soteria=cmd/|internal/,bstein-dev-home=backend/|frontend/,ariadne=ariadne/
+            - name: ARIADNE_HERMES_CODE_SUFFIXES
+              value: metis=.go,lesavka=.rs,soteria=.go,bstein-dev-home=.py|.ts|.tsx|.js,ariadne=.py
             - name: ARIADNE_HERMES_GITEA_TOKEN
               valueFrom:
                 secretKeyRef:

services/monitoring/helmrelease.yaml

@@ -749,10 +749,29 @@ spec:
     config:
       global:
         resolve_timeout: 5m
+        # Mailu accepts relay for local domains from inside the cluster, so no
+        # submission credentials are needed for mail addressed to bstein.dev.
+        smtp_smarthost: mailu-front.mailu-mailserver.svc.cluster.local:25
+        smtp_from: alertmanager@bstein.dev
+        smtp_require_tls: false
       route:
         receiver: default
         group_wait: 30s
         group_interval: 5m
         repeat_interval: 2h
+        routes:
+          # Triage escalations are the only alerts mailed today; everything
+          # else stays on the silent default receiver until it is tuned.
+          - receiver: email
+            matchers:
+              - service = hermes-triage
+            group_wait: 60s
+            repeat_interval: 12h
       receivers:
         - name: default
+        - name: email
+          email_configs:
+            - to: brad@bstein.dev
+              send_resolved: true
+              headers:
+                Subject: '[atlas] {{ .Status | toUpper }} {{ .CommonLabels.alertname }} {{ .CommonLabels.jenkins_job }}/{{ .CommonLabels.build }}'