fix: copy pyproject.toml + uv.lock to /opt/venv-template/ in agent image

.github/workflows/agent-image.yaml

@@ -1,23 +1,12 @@
-# .github/workflows/agent-image.yaml
-#
-# Builds and publishes ghcr.io/paperclipinc/hermes-agent for every hermes-agent
-# release in the supported matrix. Triggered:
-#   - Manually via workflow_dispatch (engineer picks the HERMES_VERSION).
-#   - On every push of a tag matching `agent/vX.Y.Z`.
-#
-# Cosign-signed (keyless OIDC) and SBOM via Syft.
 name: agent-image
 
 on:
   workflow_dispatch:
     inputs:
       hermes_version:
-        description: "Upstream hermes-agent release tag (e.g. v0.13.0)"
+        description: "Upstream hermes-agent release tag (e.g. v2026.5.29.2)"
         required: true
         type: string
-  push:
-    tags:
-      - 'agent/v*'
 
 permissions:
   contents: read
@@ -26,24 +15,10 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
-      - name: Resolve HERMES_VERSION
-        id: ver
-        run: |
-          set -eux
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            v="${{ inputs.hermes_version }}"
-          else
-            v="${GITHUB_REF#refs/tags/agent/}"
-          fi
-          # Strip any leading "v" for the bare package version, keep the tag form too.
-          bare="${v#v}"
-          echo "tag=${v}" >> "$GITHUB_OUTPUT"
-          echo "bare=${bare}" >> "$GITHUB_OUTPUT"
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
 
@@ -57,58 +32,15 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Verify uv.lock pins the requested hermes-agent git tag
-        run: |
-          set -eux
-          # hermes-agent is a git dependency pinned by tag in the lock's source line:
-          #   source = { git = "https://github.com/NousResearch/hermes-agent?rev=<TAG>#<sha>" }
-          # Its package `version` is independent semver (upstream uses CalVer git tags),
-          # so validate the git rev, not the version field. Refuse a mismatched lock.
-          TAG="${{ steps.ver.outputs.tag }}"
-          if ! grep -qF "NousResearch/hermes-agent?rev=${TAG}#" images/hermes-agent/uv.lock; then
-            echo "uv.lock does not pin hermes-agent at git tag ${TAG}." >&2
-            echo "Run: make agent-image-relock HERMES_VERSION=${TAG} and commit." >&2
-            exit 1
-          fi
-
       - name: Build and push
-        id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: images/hermes-agent
           file: images/hermes-agent/Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
           push: true
           tags: |
-            ghcr.io/paperclipinc/hermes-agent:${{ steps.ver.outputs.tag }}
-            ghcr.io/paperclipinc/hermes-agent:latest
+            ghcr.io/aabichou/hermes-agent:${{ inputs.hermes_version }}
+            ghcr.io/aabichou/hermes-agent:latest
           build-args: |
-            HERMES_VERSION=${{ steps.ver.outputs.tag }}
-          provenance: true
-          sbom: true
-
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3
-
-      - name: Sign image (keyless OIDC)
-        env:
-          DIGEST: ${{ steps.build.outputs.digest }}
-        run: |
-          cosign sign --yes "ghcr.io/paperclipinc/hermes-agent@${DIGEST}"
-
-      - name: Install Syft
-        uses: anchore/sbom-action/download-syft@v0
-
-      - name: Generate SBOM
-        run: |
-          syft "ghcr.io/paperclipinc/hermes-agent:${{ steps.ver.outputs.tag }}" \
-            -o spdx-json=sbom.spdx.json
-
-      - name: Attach SBOM as Cosign attestation
-        env:
-          DIGEST: ${{ steps.build.outputs.digest }}
-        run: |
-          cosign attest --yes \
-            --predicate sbom.spdx.json \
-            --type spdxjson \
-            "ghcr.io/paperclipinc/hermes-agent@${DIGEST}"
+            HERMES_VERSION=${{ inputs.hermes_version }}