hermes-webui-image had no authenticationToken, so there was no supported
non-interactive route to trigger it -- only an interactively-authenticated
Jenkins UI build worked. Give it an independently-scoped, create-only Vault
token (kv/atlas/hermes/developer-jenkins-webui, seeded by a dedicated
hermes-jenkins-webui-token-seed identity) mirroring the proven
hermes-agent-image lane exactly, never sharing state or capability with the
agent token. Adds jenkins_webui_image_build_trigger.py as the coordinator's
supported trigger route for future approved releases.
