ci(hermes-agent-image): run release boundary where git exists

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ci/Jenkinsfile.hermes-agent-image

@@ -139,6 +139,7 @@ spec:
     }
     stage('Enforce release boundary') {
       steps {
+        container('jnlp') {
         sh '''
           set -eu
           mkdir -p build
@@ -168,6 +169,7 @@ spec:
         '''
         }
       }
+    }
     stage('Reject replay before publish') {
       steps {
         withCredentials([usernamePassword(