feat: add combined Hermes Workspace image with Swarm worker support

New directory ai/hermes-workspace/ with:
- Dockerfile (multi-stage): builds workspace web UI from source,
  overlays our Hermes fork, installs tmux for Swarm workers
- entrypoint-combined.sh: starts workspace UI, waits for gateway
- himalaya-ro.sh: read-only Himalaya wrapper (shared from hermes/)

Existing ai/hermes/ Dockerfile preserved unchanged as fallback.

compose.yml changes:
- Add HERMES_DASHBOARD=1 + healthcheck to hermes service
- Add hermes-workspace service using combined image
  (build context: ./hermes-workspace, SSH build)
  - Connects to hermes:8642 (gateway) + :9119 (dashboard)
  - Shares Hermes data volume for config/sessions/skills
  - Traefik on workspace.lazyworkhorse.net (port 3000)
  - Networks: ai_backend + ai_net

ai/hermes-workspace/entrypoint-combined.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -e
+
+# ── Hermes Workspace + Swarm Worker Entrypoint ──
+# Starts Hermes Workspace web UI (port 3000) and makes
+# hermes CLI + tmux available for Swarm workers.
+# The Hermes gateway runs in a separate container (hermes:8642).
+# Swarm workers spawned here connect to the gateway via HTTP.
+# ──────────────────────────────────────────────────────────
+
+# Install custom tools from persistent volume
+if [ -f /opt/data/hermes-tools/install.sh ]; then
+  bash /opt/data/hermes-tools/install.sh || true
+fi
+
+# Wait for Hermes gateway to be healthy before starting workspace
+if [ -n "${HERMES_API_URL:-}" ]; then
+  echo "Waiting for Hermes gateway..."
+  for i in $(seq 1 30); do
+    if curl -fsS "${HERMES_API_URL}/health" >/dev/null 2>&1; then
+      echo "Gateway healthy after ${i}s"
+      break
+    fi
+    if [ "$i" -eq 30 ]; then
+      echo "WARNING: Gateway not healthy after 30s, starting workspace anyway"
+    fi
+    sleep 1
+  done
+fi
+
+# Start Hermes Workspace in foreground
+cd /workspace
+exec node --max-old-space-size=2048 server-entry.js