fix: reinstate tts_tool.py patch step in Dockerfile

Commit 8e9a75f removed the COPY+RUN of patch_tts_tool.py
because the build context was thought to be insufficient.
The build context is ai/ which contains both the Dockerfile
and patch_tts_tool.py, so COPY works fine.

Without this step the tts_tool.py silently falls through
to Edge TTS as its default provider even when
config.yaml says provider: piper, because 'piper' is not
a recognized provider in the unpatched code. This caused
the female Edge TTS voice (AriaNeural) instead of the
configured Ryan High male voice.

ai/Dockerfile

@@ -53,6 +53,14 @@ urllib.request.urlretrieve(url, base + '/en_US-ryan-high.onnx')
 urllib.request.urlretrieve(url + '.json', base + '/en_US-ryan-high.onnx.json')
 PYEOF
  
+# ---------- Patch tts_tool.py: replace Edge TTS fallback with Piper ----------
+# Edge TTS calls out to Microsoft servers — we never want that.
+# Piper runs locally on CPU, no cloud, no data leaving the machine.
+# If the patch script can't find the Edge fallback text to replace,
+# it returns a non-zero exit code and the build fails.
+COPY patch_tts_tool.py /tmp/patch_tts_tool.py
+RUN /opt/hermes/.venv/bin/python3 /tmp/patch_tts_tool.py && rm /tmp/patch_tts_tool.py
+ 
 # ---------- Patch atomic writes to preserve file permissions ----------
 # Fixes https://github.com/NousResearch/hermes-agent/issues/14181
 # tempfile.mkstemp() creates files as 0600; os.replace() preserves that mode,