chore(deps): update nousresearch/hermes-agent docker tag to v2026.7.1

[github-actions]

This PR updates the Hermes agent image (pinned in internal/hermes/hermes.go and internal/serviceoffercontroller/agent_render.go).

What Changed

• Current Version: ``
• New Version: ``
• Change Type: 🟢 Patch

Release Notes

Pre-merge gate

• Run RELEASE_SMOKE_INCLUDE_OBOL=true bash flows/release-smoke.sh and confirm flow-16-sell-agent.sh passes — its §1.1.1/§1.3.1 steps gate against .no-bundled-skills marker regressions across Hermes releases, and agent-backed offers depend on the gateway streaming chunks per-write, a behavior owned by the Hermes image.

---

Auto-generated by Renovate Bot

[bussyjd]

Pushed d89df17: this bump needs a compensating stack change.

Root cause: hermes-agent v2026.7.1 hardened the dashboard — a non-loopback (0.0.0.0) bind now requires an auth provider and the legacy --insecure flag no longer bypasses it (the hermes-0day fix). The master agent (internal/hermes) binds the dashboard on 0.0.0.0 for the k8s Service, so without a fix the hermes-dashboard sidecar CrashLoopBackOffs → the deployment never becomes Ready → release-smoke flow-04 fails.

Fix: register the bundled basic-auth provider via env (user obol, password = the agent's existing API token); /api/status stays auth-exempt so probes pass. Child agents run gateway run with no dashboard sidecar, so only the master agent needs it. Also updated flow-04's dashboard check (the loopback-only inline __HERMES_SESSION_TOKEN__ is disabled on a gated bind → assert /api/status=200 + /api/sessions=401 instead).

Validation (arm64 QA): hermes pod 2/2 Running (was 1/2 CrashLoopBackOff); paid buy flow (flow-08) green with a local vLLM QA endpoint. Verified as part of the v0.13.0-rc0 integration.

Note: two live dual-stack flows (11/14) fail on an unrelated pre-existing issue — the Alice obol-agent instance is skipped by SetupDefault when the model is configured after stack up; tracking separately.

[github-actions]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[bussyjd]

Closing as superseded by integration/v0.13.0-rc0 @ a29c826 (rolled up in #716 / release v0.13.0-rc0). All commits of this PR are contained in the RC tip (verified by ancestry/patch-id audit).