hermes: add read-only Gitea PR comment filter, break the reply loop

The gitea-events subscription woke the agent on every delivery. That is an
unbounded loop as soon as she is given a prompt that tells her to answer on
the PR: her answer is itself a pull_request_comment, which wakes her again.

Adds a Hermes route script that drops the deliveries that must never reach an
LLM call: luna's own comments (the loop guard), "deleted" actions (the body
is still in the payload, so acting on one means acting on a request that was
explicitly withdrawn), non-pull-request comments, empty bodies, and edits
that did not actually change the body — a label or attachment change fires
"edited" too. Everything else passes through unchanged.

Mounted READ-ONLY from the nix store rather than written into hermesHome.
Hermes resolves route scripts under ~/.hermes/scripts, which here is inside
/opt/data — HERMES_WRITE_SAFE_ROOT — so a filter written there would be a
loop guard sitting in the writable root of the agent it constrains. Deleting
it fails closed (Hermes treats a missing script as "ignore"), but rewriting
it to always-allow would silently restore the loop. Read-only from the store
makes that impossible and keeps the guard in git.

The script also normalises changes.body.from to always exist. Gitea omits
`changes` entirely on created events, and Hermes replaces the prompt payload
with whatever JSON the script emits, so guaranteeing the key here means a
prompt referencing {changes.body.from} renders empty instead of leaving an
unfilled placeholder.

Note the stdout contract (gateway/platforms/webhook.py): only exactly
"[SILENT]", empty output, or a nonzero exit drop a delivery. Any OTHER text
on stdout lets it through and is attached as script_output — so a stray
debug print would silently defeat the filter. All diagnostics go to stderr,
and gitea-pr-comment-filter-test.py asserts that discipline along with each
drop rule (25 cases). Run it after any edit: the fail-closed behaviour means
a syntax error produces silence, not an error.

--events is still unset; event selection remains runtime-tunable policy.
The filter covers only what must not be.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa

services/dev/gitea-hermes-webhook-relay.nix

@@ -75,6 +75,14 @@ in
   # That only works because the relay supplies X-GitHub-Event — see the
   # header comment above.
   #
+  # --script does the selection that MUST NOT be retunable at runtime.
+  # hosts/mars/gitea-pr-comment-filter.py drops luna's own comments before
+  # any LLM call, which is what stops the reply loop: the prompt tells her to
+  # answer on the PR, and her answer is itself a pull_request_comment. It is
+  # bind-mounted read-only from the nix store (see hosts/mars/hermes-agent.nix)
+  # so the agent cannot edit its own guard out. Hermes resolves the name
+  # relative to ~/.hermes/scripts, hence the bare filename here.
+  #
   # The secret is read from the CONTAINER's environment ($GITEA_HERMES_
   # WEBHOOK_SECRET, injected via sops.templates."hermes-agent.env"), which is
   # why hosts/mars/secrets.nix restarts podman-hermes-agent BEFORE this unit
@@ -108,6 +116,7 @@ in
         hermes webhook subscribe gitea-events \
           --secret "$GITEA_HERMES_WEBHOOK_SECRET" \
           --description "Forward authenticated Gitea events to L.U.N.A." \
+          --script gitea-pr-comment-filter.py \
           --deliver telegram --deliver-chat-id "15151223"
       '
     '';