mars: add hermes CLI shell alias

darman's own podman is rootless while the container runs under root's
(system) podman, so plain `podman exec` couldn't see it. Alias runs it
with sudo against the right socket.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Du1WQRk1F8DenrPhf8TofF

hosts/mars/hermes-agent.nix

@@ -23,7 +23,9 @@
 #     TELEGRAM_ALLOWED_USERS.
 #   - Runs as a rootful podman container (services/containers.nix) with its
 #     OWN numeric uid/gid — not darman, who is in the "hermes" group for
-#     host-level debugging only (`podman exec -it hermes-agent hermes ...`).
+#     host-level debugging only (`hermes ...` alias below, needs sudo since
+#     the container itself runs under root's podman, not darman's rootless
+#     one).
 #
 # Dashboard (HERMES_DASHBOARD=1) is gated behind Authentik, same setup as on
 # jupiter. Its default bind (0.0.0.0:9119) fails closed without an auth
@@ -75,6 +77,13 @@ in
   users.groups.hermes.gid = 983;
   users.users.darman.extraGroups = [ "hermes" ];
 
+  # `hermes <args>` on mars == `sudo podman exec -it hermes-agent hermes <args>`.
+  # sudo is required: virtualisation.oci-containers runs rootful (system)
+  # podman, a separate namespace from darman's own rootless `podman`/`docker`
+  # — darman's "hermes"/"docker" group membership only grants filesystem
+  # access to the bind-mounted state dir, not to root's container socket.
+  programs.zsh.shellAliases.hermes = "sudo podman exec -it hermes-agent hermes";
+
   systemd.tmpfiles.rules = [
     "d ${stateDir} 0750 root hermes -"
   ];