hermes: run the reviewed agent image and arm the takeover

Pins hermes-agent to sha256:4a385fbd, built by hermes-agent-image #11 from
this exact main revision through the daemonless Kaniko lane. Enables
kanban.auto_supervise and returns chat tenancy to the documented four slots.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

services/hermes/agent-configmap.yaml

@@ -93,7 +93,7 @@ data:
       # implement->review->repair->re-review chain by creating Kanban cards
       # only (subscription lanes), never merging/approving. Bounded by the
       # cycle and concurrent-chain ceilings below.
-      auto_supervise: false
+      auto_supervise: true
       supervise_interval_seconds: 30
       supervise_max_cycles: 5
       supervise_max_chains: 20

services/hermes/chat-statefulset.yaml

@@ -10,7 +10,7 @@ metadata:
     kustomize.toolkit.fluxcd.io/force: enabled
 spec:
   serviceName: hermes-chat-tenant
-  replicas: 6
+  replicas: 4
   podManagementPolicy: Parallel
   persistentVolumeClaimRetentionPolicy:
     whenDeleted: Retain

services/hermes/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 namespace: hermes
 images:
   - name: registry.bstein.dev/bstein/hermes-agent
-    digest: sha256:37ebf720c783ae908a602916ffccf88d43d205a157957f5dc4b487867aee45e7
+    digest: sha256:4a385fbd04ae1e3e8ca0237db98a318606a2a03786ef467757b8da5eee4e4b37
 resources:
   - namespace.yaml
   - scm-common