chore(deps): update nousresearch/hermes-agent docker tag to v2026.7.1

[github-actions]

This PR updates the Hermes agent image (pinned in internal/hermes/hermes.go and internal/serviceoffercontroller/agent_render.go).

What Changed

• Current Version: ``
• New Version: ``
• Change Type: 🟢 Patch

Release Notes

Pre-merge gate

• Run RELEASE_SMOKE_INCLUDE_OBOL=true bash flows/release-smoke.sh and confirm flow-16-sell-agent.sh passes — its §1.1.1/§1.3.1 steps gate against .no-bundled-skills marker regressions across Hermes releases, and agent-backed offers depend on the gateway streaming chunks per-write, a behavior owned by the Hermes image.

---

Auto-generated by Renovate Bot

[bussyjd]

Pushed d89df17: this bump needs a compensating stack change.

Root cause: hermes-agent v2026.7.1 hardened the dashboard — a non-loopback (0.0.0.0) bind now requires an auth provider and the legacy --insecure flag no longer bypasses it (the hermes-0day fix). The master agent (internal/hermes) binds the dashboard on 0.0.0.0 for the k8s Service, so without a fix the hermes-dashboard sidecar CrashLoopBackOffs → the deployment never becomes Ready → release-smoke flow-04 fails.

Fix: register the bundled basic-auth provider via env (user obol, password = the agent's existing API token); /api/status stays auth-exempt so probes pass. Child agents run gateway run with no dashboard sidecar, so only the master agent needs it. Also updated flow-04's dashboard check (the loopback-only inline __HERMES_SESSION_TOKEN__ is disabled on a gated bind → assert /api/status=200 + /api/sessions=401 instead).

Validation (arm64 QA): hermes pod 2/2 Running (was 1/2 CrashLoopBackOff); paid buy flow (flow-08) green with a local vLLM QA endpoint. Verified as part of the v0.13.0-rc0 integration.

Note: two live dual-stack flows (11/14) fail on an unrelated pre-existing issue — the Alice obol-agent instance is skipped by SetupDefault when the model is configured after stack up; tracking separately.