feat(demo): preflight the agent-pool cap and open code-demo PRs

Two conditions silently break a rehearsal. A saturated Kubernetes agent pool
leaves the demo build queued reporting that all nodes are offline, and an open
hermes-repair PR makes the duplicate guard refuse a new proposal. Report both
so the operator sees them before starting rather than mid-demo.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_triage_demo.sh

@@ -73,6 +73,19 @@ cmd_preflight() {
   local queued
   queued="$(jenkins_get '/queue/api/json' | python3 -c 'import json,sys; print(len(json.load(sys.stdin)["items"]))')"
   note "jenkins queue depth: $queued (demo is fastest when this is 0)"
+  # The Kubernetes cloud caps concurrent agent pods at containerCapStr. When
+  # real CI saturates that cap the demo build sits in the queue reporting
+  # "all nodes are offline" and the timings in the runbook do not apply.
+  local agents cap
+  cap="$(kubectl -n jenkins get cm jenkins-jcasc -o jsonpath='{.data.jenkins\.yaml}' 2>/dev/null |
+    grep -o 'containerCapStr: "[0-9]*"' | head -1 | grep -o '[0-9]*' || echo 5)"
+  agents="$(kubectl -n jenkins get pods --no-headers 2>/dev/null | grep -cE '\-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{5}' || true)"
+  note "jenkins agent pods: ${agents:-0}/${cap:-5} (a full pool stalls the demo — wait for a free slot)"
+  local open_prs
+  open_prs="$(curl -s -H "Authorization: token ${GITEA_TOKEN:-}" \
+    "${GITEA_URL:-https://scm.bstein.dev}/api/v1/repos/bstein/hermes-code-demo/pulls?state=open" 2>/dev/null |
+    python3 -c 'import json,sys; print(len(json.load(sys.stdin)))' 2>/dev/null || echo '?')"
+  note "open hermes-code-demo PRs: $open_prs (must be 0 — the duplicate guard refuses while one is open)"
 }
 
 cmd_status() {