Provisions a dedicated PR-tier gitea account (luna) with branch protection restricting master push/merge/approve to darman only, then wires git and tea directly into the hermes-agent container (mounted from the host's Nix store, credential-store + tea login set up by a host-side prepare oneshot, repo cloned inside Hermes's own writable sandbox root at /opt/data/workspace/homelab). Replaces an earlier standalone MCP-server approach, scrapped in favor of direct CLI access for simplicity. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ