fix(hermes): require rpi5 for worker (keep the heavy agent off rpi4)

Un-pinning let the scheduler land worker on titan-12 (rpi4). The agent is heavy
enough that an rpi4 risks the /api/status slowness that trips its liveness probe
- the exact flap we are avoiding. Make hardware=rpi5 a hard requirement so it
runs only on rpi5 storage workers (excluding the saturated/known-flaky ones);
the scheduler places it on a roomy rpi5 (titan-05).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf

services/hermes/agent-deployment.yaml

@@ -108,6 +108,12 @@ spec:
                   - key: node-role.kubernetes.io/worker
                     operator: In
                     values: ["true"]
+                  # Require rpi5: the agent is heavy and an rpi4 is slow enough to
+                  # risk tripping the /api/status liveness probe. rpi5 storage
+                  # workers only, excluding the saturated/known-flaky ones.
+                  - key: hardware
+                    operator: In
+                    values: [rpi5]
                   - key: kubernetes.io/hostname
                     operator: NotIn
                     values: [titan-04, titan-06, titan-08, titan-13, titan-14, titan-17, titan-18, titan-19]