fix: add gosu to hermes SSH keyscan to honcho builder

- Install gosu in hermes image so run-multi-gateways.sh can drop
  privileges when USER hermes is set at the end of the Dockerfile.
- Add openssh-client + ssh-keyscan to the openconcho-builder stage
  so SSH host key verification passes during the first Gitea clone.

ai/hermes/Dockerfile

@@ -13,6 +13,7 @@ FROM nousresearch/hermes-agent:latest
 USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        gosu \
         libportaudio2 ca-certificates poppler-utils imagemagick \
         libolm-dev \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended \