hermes: give the gitea-events route its prompt and event filter

Completes the subscription: it had a secret, a delivery target and a script,
but no prompt and no event list, so it woke the agent on every forwarded
event with nothing to tell her what to do.

--events pull_request_comment narrows the route to the one event the prompt
handles. This only works because the relay copies X-Gitea-Event into
X-GitHub-Event; without that every delivery arrives as "unknown" and matches
nothing. Gitea sends pull_request_comment distinctly from issue_comment, so
plain issue comments no longer reach the agent at all. The Gitea-side hook
still posts the full event set to the relay and Hermes drops the rest before
any LLM call.

The prompt lives in hosts/mars/gitea-pr-comment-prompt.md, mounted read-only
next to the filter, and is read with $(cat) at subscribe time rather than
passed inline. That is not only about escaping: the text has to survive nix
`` string escaping, the systemd unit file, and `podman exec sh -c '...'`
single-quoting. It contains an apostrophe ("the PR's head branch") that
would terminate that single-quoted string early. Read from a file at runtime
the content never passes through shell source, so it can contain anything.
Verified end to end against the rendered unit with stubbed podman/hermes:
the value reaching --prompt is byte-identical to the repo file apart from
the trailing newline that command substitution strips.

`set -eu` inside the container shell is load-bearing. Without it a missing
prompt file makes cat fail, the substitution yields "", and the subscription
is created with an empty prompt -- a silent failure that still looks like a
healthy unit.

On what read-only does not buy: it protects the sources, and this unit
re-subscribes from them on every start, so a restart restores the intended
prompt, filter and events. The live subscription itself lives in
webhook_subscriptions.json under /opt/data and is hot-reloaded, which is
inside the agent's own write-safe root -- a self-modification would stick
until this unit next runs.

The prompt keeps its own stop conditions even though the filter already drops
those deliveries, and says explicitly that reaching them means the filter
failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa

hosts/mars/hermes-agent.nix

@@ -103,6 +103,15 @@ let
     builtins.readFile ./gitea-pr-comment-filter.py
   );
 
+  # The route prompt, mounted read-only for the same reason as the filter and
+  # kept in a file rather than inline in the subscribe command: it is 60 lines
+  # of markdown containing apostrophes and {placeholders}, which would have to
+  # survive nix string escaping, the systemd unit, and `podman exec sh -c`
+  # quoting. A file crosses all three untouched and stays diffable in git.
+  prCommentPrompt = pkgs.writeText "gitea-pr-comment-prompt.md" (
+    builtins.readFile ./gitea-pr-comment-prompt.md
+  );
+
   # hermesHome as the CONTAINER sees it (the bind mount below). Anything
   # written host-side that gets READ back inside the container must use this
   # prefix, not hermesHome — see the credential.helper below, which was
@@ -165,6 +174,7 @@ in
       # bind mount of hermesHome, so this directory has to exist HOST-side
       # before podman can mount a file inside it.
       mkdir -p ${hermesHome}/scripts
+      mkdir -p ${hermesHome}/prompts
 
       export HOME=${hermesHome}
       export GIT_CONFIG_GLOBAL=${hermesHome}/.gitconfig
@@ -209,7 +219,7 @@ in
       # here as root, and Hermes reads its scripts as uid ${hermesUid}. The
       # mounted filter itself is world-readable 0444 from the store, so only
       # the directory needs handing over.
-      chown ${hermesUid}:${hermesGid} ${hermesHome}/scripts
+      chown ${hermesUid}:${hermesGid} ${hermesHome}/scripts ${hermesHome}/prompts
 
       if [ -d ${hermesHome}/.config ]; then
         chown ${hermesUid}:${hermesGid} ${hermesHome}/.config
@@ -243,6 +253,7 @@ in
       # Read-only: see prCommentFilter above. Hermes resolves route scripts
       # under ~/.hermes/scripts, which is /opt/data/scripts in here.
       "${prCommentFilter}:/opt/data/scripts/gitea-pr-comment-filter.py:ro"
+      "${prCommentPrompt}:/opt/data/prompts/gitea-pr-comment.md:ro"
 
       "/nix/store:/nix/store:ro"
       "${pkgs.git}/bin/git:/usr/local/bin/git:ro"