mars(mnemosyne): fix env build and plugin symlink target

- fetchPypi: sdists are published underscore-named, so the hyphenated
  pname 404'd.
- sitePackages is relative; prefix the env path so the unit's -d check
  and the symlink point at the store.
- hermes_memory_provider ships in mnemosyne-memory, not mnemosyne-hermes;
  move the import check accordingly.
- Drop the unused /opt/data/mnemosyne-env mount, the orphaned
  requirements.txt, and trim comments.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

hosts/mars/hermes-agent.nix

@@ -74,11 +74,7 @@ let
     builtins.readFile ./gitea-pr-review-prompt.md
   );
 
-  # Mnemosyne memory provider (local SQLite, third-party plugin — not bundled
-  # with the official image). Fully built as a Nix derivation — see
-  # pkgs/mnemosyne-env.nix — and mounted READ-ONLY into the container at a
-  # fixed path. The oneshot near the bottom of this file only writes the
-  # plugin symlink Docker needs at $HERMES_HOME/plugins/mnemosyne.
+  # Mnemosyne memory provider: third-party plugin, not in the image.
   mnemosyneEnv = pkgs.callPackage ../../pkgs/mnemosyne-env.nix { };
 
   # Wire event names (X-GitHub-Event) each route accepts — NOT the
@@ -235,15 +231,6 @@ in
       "${hermesHome}:/opt/data"
       "${dropboxDir}:/opt/data/dropbox"
 
-      # Mnemosyne memory provider — a Nix-built python env, mounted :ro.
-      # Nothing fetched at boot, nothing writable from inside the container.
-      # The plugin symlink the oneshot at the bottom of this file writes
-      # points at the canonical store path (site-packages passthru), which
-      # is visible inside thanks to the existing /nix/store ro mount, so
-      # this /opt/data restatement is a readability alias, not a load
-      # bearing path.
-      "${mnemosyneEnv}:/opt/data/mnemosyne-env:ro"
-
       # luna's Obsidian vault, synced with CouchDB on jupiter by
       # livesync-bridge.nix. Under /opt/data so she can write notes, not just
       # read them; the bridge runs as this same uid/gid so no chown is needed.
@@ -435,26 +422,9 @@ in
     '';
   };
 
-  # ---- Mnemosyne memory provider ----------------------------------------
-  # The provider's Python closure (mnemosyneEnv, callPackage'd
-  # pkgs/mnemosyne-env.nix above) is a READ-ONLY nix store path mounted into
-  # the container — nothing fetched at boot, nothing inside the container can
-  # write to it, and the mono-repo reproducibility story applies. Hermes only
-  # needs one mutable pickup point: $HERMES_HOME/plugins/mnemosyne, the
-  # symlink its discovery scan looks for. Both the plugin wrapper and its
-  # sibling `mnemosyne` core package live in that env's single site-packages,
-  # so one link covers them.
-  #
-  # Path handling: the symlink target is spelled in the CONTAINER's path
-  # space (/opt/data/...), because Hermes resolves the plugin from inside the
-  # container — the same host/container mismatch the webhook prompts already
-  # navigate via containerHome. Host-side the identical literal resolves
-  # onto the same store path through hermesHome's bind mount.
-  #
-  # Failure posture: after=, not requires= — a failed link write leaves the
-  # container running with whatever memory.provider falls back to Hermes's
-  # built-in memory, not a dead bot. The ro mount itself is evaluated at
-  # build time, so there is nothing provisionable to drift at runtime.
+  # Hermes discovers memory providers under $HERMES_HOME/plugins; the target
+  # is a store path, readable in the container via the /nix/store ro mount.
+  # wantedBy, not requiredBy: a failure leaves Hermes on built-in memory.
   systemd.services.hermes-agent-mnemosyne-plugin = {
     description = "Link Mnemosyne provider into the Hermes plugin dir";
     before = [ "podman-hermes-agent.service" ];
@@ -468,27 +438,13 @@ in
     };
     script = ''
       set -euo pipefail
-
       pluginsDir=${hermesHome}/plugins
       pluginDir=$pluginsDir/mnemosyne
-      # Target is the STORE path itself, not a /opt/data restatement: the
-      # container already ro-mounts /nix/store for git/tea (see the volumes
-      # list), so the identical literal resolves on both sides of the bind
-      # mount. Using the canonical store path directly — not the
-      # /opt/data/mnemosyne-env mount — keeps one truth and still works
-      # whether Hermes resolves the link inside the container or host-side
-      # during debugging.
-      target="${mnemosyneEnv.sitePackages}/hermes_memory_provider"
-
-      if [ ! -d "$target" ]; then
-        echo "hermes_memory_provider not found in the mnemosyne env — unit bug, not transient" >&2
-        exit 1
-      fi
+      target=${mnemosyneEnv}/${mnemosyneEnv.sitePackages}/hermes_memory_provider
+      [ -d "$target" ] || { echo "$target missing" >&2; exit 1; }
 
       mkdir -p "$pluginsDir"
       chown ${hermesUid}:${hermesGid} "$pluginsDir"
-      # Atomic swap: write to a temp name, rename over the old link. `-T`
-      # errors loudly if the target turned into a directory for any reason.
       ln -sfn "$target" "$pluginDir.new"
       mv -Tf "$pluginDir.new" "$pluginDir"
       chown -h ${hermesUid}:${hermesGid} "$pluginDir"