hermes: decouple node maintenance health

clusters/atlas/flux-system/applications/hermes/kustomization.yaml

@@ -36,10 +36,9 @@ spec:
     # would stall hermes-chat and hermes-observer-bindings, which dependsOn
     # hermes. The pool reports its own health through the worker readiness probe,
     # the per-ordinal mediator /ready endpoint, and the coordinator on :9007.
-    - apiVersion: apps/v1
-      kind: DaemonSet
-      name: hermes-node-ssh-access
-      namespace: hermes
+    # The node SSH hardener is deliberately absent. It reconciles every node,
+    # including offline and maintenance hosts, so its availability must not
+    # turn a node-local account issue into a blocked owner-service rollout.
     - apiVersion: apps/v1
       kind: Deployment
       name: hermes

testing/tests/test_hermes_cli_lanes_access.py

@@ -90,11 +90,11 @@ def test_agent_refreshes_routes_after_restoring_cli_logins():
     ) in hermes_mounts
 
 
-def test_flux_health_checks_follow_the_owner_oauth_sidecar():
+def test_flux_health_checks_gate_the_owner_without_node_maintenance():
     flux = yaml.safe_load(FLUX_HERMES.read_text())
     checks = {(item["kind"], item["name"]) for item in flux["spec"]["healthChecks"]}
     assert ("Deployment", "hermes-agent") in checks
-    assert ("DaemonSet", "hermes-node-ssh-access") in checks
+    assert ("DaemonSet", "hermes-node-ssh-access") not in checks
     assert ("Deployment", "oauth2-proxy-hermes-agent") not in checks