fix: add missing USER hermes at end of Dockerfile

The Dockerfile was switching to USER root for the final chown but never
switched back to USER hermes. This caused ALL container processes to run
as root (uid 0) instead of the hermes user (uid 10000).

The entrypoint's gosu privilege drop only caught the main exec chain,
leaving backgrounded subprocesses (dashboard PTY sessions, workers with
start_new_session=True) running as root — creating files owned by root
in ExoKortex and breaking Syncthing sync.

Adding USER hermes at the end ensures the container runs unprivileged
and ALL child processes inherit uid 10000 from the start.

ai/hermes/Dockerfile

@@ -75,3 +75,8 @@ USER root
 RUN chown -R hermes:hermes /opt/hermes/tools /opt/hermes/toolsets.py
 
 VOLUME [ "/opt/data" ]
+
+# Switch to the hermes user so the container runs unprivileged.
+# All child processes inherit this user — no more orphan root processes
+# that escape gosu privilege drops in the entrypoint.
+USER hermes