fix: add gosu to hermes SSH keyscan to honcho builder

- Install gosu in hermes image so run-multi-gateways.sh can drop
  privileges when USER hermes is set at the end of the Dockerfile.
- Add openssh-client + ssh-keyscan to the openconcho-builder stage
  so SSH host key verification passes during the first Gitea clone.

ai/hermes/Dockerfile

@@ -13,6 +13,7 @@ FROM nousresearch/hermes-agent:latest
 USER root
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        gosu \
         libportaudio2 ca-certificates poppler-utils imagemagick \
         libolm-dev \
         texlive-latex-base texlive-latex-extra texlive-fonts-recommended \

ai/honcho/Dockerfile

@@ -28,9 +28,10 @@ ENV PATH=$PNPM_HOME:$PATH
 RUN corepack enable && corepack prepare pnpm@latest --activate
 
 WORKDIR /app
-RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y git openssh-client && rm -rf /var/lib/apt/lists/**
 
 ARG OPENCONCHO_SHA=3b5c3293fc18d768dbe85285264a8d66c896bd81
+RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan -p 2222 code.lazyworkhorse.net >> ~/.ssh/known_hosts 2>/dev/null
 RUN --mount=type=ssh git clone --depth 1 ssh://git@code.lazyworkhorse.net:2222/gortium/openconcho.git /app && \
     git -C /app fetch --depth 1 origin ${OPENCONCHO_SHA} && \
     git -C /app checkout ${OPENCONCHO_SHA}