fix: add start-hermes.sh baked into image, replace broken ENTRYPOINT

- New start-hermes.sh: multi-profile launcher that works with s6-overlay's
  main-program model (replaces bash->tini->entrypoint.sh chain)
- Dockerfile: COPY start-hermes.sh into /usr/local/bin/ alongside
  run-multi-gateways.sh (which is now unused but kept for reference)
- compose.yml: remove entrypoint override, CMD now points at
  /usr/local/bin/start-hermes.sh via the image default ENTRYPOINT

Fixes the SIGTERM crash loop caused by S6_CMD_ARG0 being unset when the
deprecated entrypoint.sh shim bypassed s6-overlay's /init.

ai/compose.yml

@@ -11,7 +11,7 @@ services:
     # for proper s6-overlay supervision. The CMD runs our multi-profile launcher
     # which spawns per-profile gateways in background, then the default gateway
     # in foreground (keeps the container alive).
-    command: ["/opt/data/start-hermes.sh"]
+    command: ["/usr/local/bin/start-hermes.sh"]
     environment:
       - HERMES_UID=10000
       - HERMES_GID=10000