Supersedes the venv-based fix attempt in 694317a entirely: replaces the
runtime side-venv with a python3.withPackages derivation
(pkgs/mnemosyne-env.nix: mnemosyne-memory 3.15.1 + mnemosyne-hermes 0.5.0
via fetchPypi, base deps only). Env mounted :ro into the container; the
oneshot only writes the plugins/mnemosyne symlink to the env's
site-packages passthru — a canonical store path valid on both sides. No
runtime fetch, no stamp, no root-executes-luna-writable-code, no
host/container path mismatch, no config.yaml sed.
Mnemosyne isn't bundled with the official image; third-party PyPI plugin.
Built as a side venv + plugin symlink inside hermesHome so it lands
inside HERMES_WRITE_SAFE_ROOT and survives image rebuilds. Pinned
requirements captured from a validated live install.
luna