hermes: add read-only Gitea PR comment filter, break the reply loop

The gitea-events subscription woke the agent on every delivery. That is an
unbounded loop as soon as she is given a prompt that tells her to answer on
the PR: her answer is itself a pull_request_comment, which wakes her again.

Adds a Hermes route script that drops the deliveries that must never reach an
LLM call: luna's own comments (the loop guard), "deleted" actions (the body
is still in the payload, so acting on one means acting on a request that was
explicitly withdrawn), non-pull-request comments, empty bodies, and edits
that did not actually change the body — a label or attachment change fires
"edited" too. Everything else passes through unchanged.

Mounted READ-ONLY from the nix store rather than written into hermesHome.
Hermes resolves route scripts under ~/.hermes/scripts, which here is inside
/opt/data — HERMES_WRITE_SAFE_ROOT — so a filter written there would be a
loop guard sitting in the writable root of the agent it constrains. Deleting
it fails closed (Hermes treats a missing script as "ignore"), but rewriting
it to always-allow would silently restore the loop. Read-only from the store
makes that impossible and keeps the guard in git.

The script also normalises changes.body.from to always exist. Gitea omits
`changes` entirely on created events, and Hermes replaces the prompt payload
with whatever JSON the script emits, so guaranteeing the key here means a
prompt referencing {changes.body.from} renders empty instead of leaving an
unfilled placeholder.

Note the stdout contract (gateway/platforms/webhook.py): only exactly
"[SILENT]", empty output, or a nonzero exit drop a delivery. Any OTHER text
on stdout lets it through and is attached as script_output — so a stray
debug print would silently defeat the filter. All diagnostics go to stderr,
and gitea-pr-comment-filter-test.py asserts that discipline along with each
drop rule (25 cases). Run it after any edit: the fail-closed behaviour means
a syntax error produces silence, not an error.

--events is still unset; event selection remains runtime-tunable policy.
The filter covers only what must not be.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa

hosts/mars/hermes-agent.nix

@@ -90,6 +90,19 @@ let
   # is hers to make, anywhere inside HERMES_WRITE_SAFE_ROOT=/opt/data.
   giteaHost = "git.mgaction.town";
 
+  # luna's webhook filter, mounted READ-ONLY below. It lives in the nix store
+  # rather than being written into hermesHome because hermesHome IS
+  # HERMES_WRITE_SAFE_ROOT: a filter dropped there is a loop guard sitting
+  # inside the writable root of the agent it constrains, and she could edit
+  # it back out. Deleting it would fail closed (Hermes treats a missing
+  # script as "ignore"), but rewriting it to always-allow would silently
+  # restore the reply loop. Read-only from the store makes that impossible
+  # and keeps the guard versioned in git — same reasoning as the git/tea
+  # binaries mounted below.
+  prCommentFilter = pkgs.writeText "gitea-pr-comment-filter.py" (
+    builtins.readFile ./gitea-pr-comment-filter.py
+  );
+
   # hermesHome as the CONTAINER sees it (the bind mount below). Anything
   # written host-side that gets READ back inside the container must use this
   # prefix, not hermesHome — see the credential.helper below, which was
@@ -147,6 +160,11 @@ in
     script = ''
       mkdir -p ${hermesHome}
       mkdir -p ${dropboxDir}
+      # Parent for the read-only filter bind-mounted at
+      # /opt/data/scripts/gitea-pr-comment-filter.py. /opt/data is itself a
+      # bind mount of hermesHome, so this directory has to exist HOST-side
+      # before podman can mount a file inside it.
+      mkdir -p ${hermesHome}/scripts
 
       export HOME=${hermesHome}
       export GIT_CONFIG_GLOBAL=${hermesHome}/.gitconfig
@@ -187,6 +205,12 @@ in
       chown ${hermesUid}:${hermesGid} \
         ${hermesHome}/.gitconfig \
         ${hermesHome}/.git-credentials
+      # Same cont-init caveat as the files above: the directory is created
+      # here as root, and Hermes reads its scripts as uid ${hermesUid}. The
+      # mounted filter itself is world-readable 0444 from the store, so only
+      # the directory needs handing over.
+      chown ${hermesUid}:${hermesGid} ${hermesHome}/scripts
+
       if [ -d ${hermesHome}/.config ]; then
         chown ${hermesUid}:${hermesGid} ${hermesHome}/.config
       fi
@@ -216,6 +240,10 @@ in
       # is read-only content-addressed build output, not a source of
       # secrets, so mounting the whole thing read-only costs nothing beyond
       # the two specific binaries actually being reachable.
+      # Read-only: see prCommentFilter above. Hermes resolves route scripts
+      # under ~/.hermes/scripts, which is /opt/data/scripts in here.
+      "${prCommentFilter}:/opt/data/scripts/gitea-pr-comment-filter.py:ro"
+
       "/nix/store:/nix/store:ro"
       "${pkgs.git}/bin/git:/usr/local/bin/git:ro"
       "${pkgs.tea}/bin/tea:/usr/local/bin/tea:ro"