Shell prefix didn't work with nohup+gosu chain - Docker compose
env var API_SERVER_ENABLED=true leaked through. Using 'env'
command guarantees the override is in the child process env.
- Use /opt/hermes/.venv/bin/hermes (full path) — not on PATH
before entrypoint.sh sources the venv
- Wrap with gosu hermes to avoid root guard in gateway run
- Add error check if hermes binary doesn't exist
