fix(demo): encode the Jenkins tree selector so run does not die on curl

hermes_code_demo.sh run crashed before it did anything, with a JSON traceback
pointing at the parser rather than the cause. Jenkins tree selectors use square
brackets; this curl build treats them as glob metacharacters and declines to
send the request, so the body came back empty and json.load reported column 1.

Encoded, and an empty body now says which job and which Jenkins rather than
raising from inside the parser. The crash was harmless as crashes go - it
happened before the defect was seeded, so nothing was pushed - but it happened
at the exact moment a demo starts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_demo_lib.sh

@@ -52,8 +52,18 @@ jenkins_post() {
 }
 gitea_get() { curl -s --max-time 25 -H "Authorization: token ${GITEA_TOKEN:-}" "$GITEA_URL$1"; }
 
+# Jenkins tree selectors use square brackets, which some curl builds treat as
+# glob metacharacters and refuse to send - the request never leaves, the body
+# is empty, and the JSON parse dies with a traceback that says nothing about
+# the real cause. Encoded, so the demo does not depend on how curl was built.
 last_build_number() {
-  jenkins_get "/job/$1/api/json?tree=lastBuild[number]" |
+  local body
+  body="$(jenkins_get "/job/$1/api/json?tree=lastBuild%5Bnumber%5D")"
+  if [ -z "$body" ]; then
+    echo "Jenkins returned nothing for job $1 (check credentials and $JENKINS_URL)" >&2
+    return 1
+  fi
+  printf '%s' "$body" |
     python3 -c 'import json,sys; print(json.load(sys.stdin)["lastBuild"]["number"])'
 }