feat(hermes): replace Dockerfile with python:3.11-slim based image with Chromium

ai/Dockerfile

@@ -15,8 +15,11 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \
-        curl poppler-utils imagemagick emacs-nox \
-        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science && \
+        curl poppler-utils imagemagick emacs-nox qemu-user-static binfmt-support qemu-user-binfmt && \
+        texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \
+        chromium xvfb \
+        fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \
+        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 && \
     rm -rf /var/lib/apt/lists/*
 
 # Non-root user for runtime; UID can be overridden via HERMES_UID at runtime

ai/hermes/entrypoint.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -e
+
+# Hermes Agent entrypoint script
+# Installs custom tools and runtime dependencies,
+# then delegates to the passed command (usually "gateway run").
+
+# Install custom tools from persistent volume if available
+if [ -f /opt/data/hermes-tools/install.sh ]; then
+    bash /opt/data/hermes-tools/install.sh
+fi
+
+# Install additional runtime deps (idempotent)
+if command -v uv &>/dev/null; then
+    uv pip install --system --no-cache-dir --quiet \
+        openai mautrix[encryption] 2>/dev/null || true
+fi
+
+# Execute the passed command with tini for proper signal handling
+exec tini -g -- "$@"