Rename two public Hermes hostnames across the repo:
chat.hermes.bstein.dev -> hermes.bstein.dev
triage.hermes.bstein.dev -> triage.bstein.dev
agent.hermes.bstein.dev is left untouched. That rename ships separately and
must merge last, because it is the coordinator's own access point.
Covers CoreDNS host entries, the shared hermes-sites certificate SANs and
the ingress rules, Keycloak OIDC redirect/origin/post-logout URLs,
oauth2-proxy redirect URLs, CORS and allowed-origin settings, dashboard
public URLs, the Ariadne proposal UI link, ZAP baseline scan targets, the
operator and agent instruction text, the Telegram sign-in prompts, and the
Docker/UI references.
Knowledge catalogs and the HTTP diagram were regenerated with
scripts/render/knowledge_render_atlas.py rather than hand-edited. Only the
rename delta is carried here: the committed catalogs on main are already
stale by roughly 1650 lines, and that drift is left for a separate cleanup.
Repo-only change. After merge it needs the Keycloak ensure script re-run and
certificate reissuance; existing oauth2-proxy sessions are invalidated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
