feat: CI dev/prod parity, fix flaky builds, upgrade Node to 26

[gitricko]

Problem

CI builds were flaky — the Docker smoke test intermittently failed with
two distinct root causes, both causing the self-check to exit with code 2.

Root Cause 1: Dashboard crash on startup (intermittent)

The dashboard's startup runs a web UI staleness check and tries
npm install --workspace web when it detects the dist is outdated.
In CI this fails because the web UI is already built during the Docker
image build step — the container doesn't have full dev dependencies
at runtime. When the dashboard crashes, socat on port 9119 forwards
to nothing, and self-check reports "no response from http://localhost:9119".

Fix: Pass --skip-build to hermes dashboard in start-hermes.sh
so it serves the pre-built dist without trying to rebuild on startup.

Root Cause 2: Self-check runs before init scripts finish

The CI workflow started the container and immediately ran self-check.
start-hermes.sh runs as a background process — by the time self-check
executed, the config file either didn't exist yet or was the root-owned
Docker build artifact (not the runtime abc-owned version). This caused:

• ❌ Config no config at /config/.hermes/config.yaml (critical failure)
• self-check: line 398: /tmp/health-report.json: Permission denied
  (clobbered the exit code from 2 to 1)

Fix: Wait for port 9119 to respond (HTTP 200/302/401) before running
self-check. Port 9119 responding means start-hermes.sh has finished
and created all runtime files as abc. Also fixed the JSON report write
with || true to prevent permission errors from overriding the exit code.

Changes

CI Workflow (docker-publish.yml)

• Start test container via make start with NO_LOGS=1 (dev/prod parity)
• Run self-check as user abc (matching production)
• Wait for port 9119 health check before self-check (was: no wait)
• Remove redundant 150s dashboard wait loop (self-check has its own polling)

Self-Check (self-check.sh)

• Add Ollama health checks (binary, API, model listing, embedding)
  ported from hermes-codespace (warnings only, not critical)
• Fix exit code bug: JSON report write with || true so permission
  errors don't clobber the exit code from 2 to 1

Startup (start-hermes.sh)

• --skip-build flag for dashboard startup

Dead Code Cleanup (Kapati Guidelines — references PR #33)

• Remove Python stamp-writing block from Dockerfile (PR Update HERMES_VERSION to v2026.8.13 + Hermes WebTop Dashboard Fix #33's
  _write_web_ui_build_stamp() doesn't exist in v2026.8.13)
• Remove docker/01-copy-web-ui-stamp.sh (dead init script, never invoked)
• Remove mkdir -p /opt/hermes-prebuilt from Dockerfile

Other

• Upgrade Node.js 24.18.0 → 26.7.0
• Set terminal.cwd to $HOME during init
• Update omniroute combo models (opencode-zen variants)
• NO_LOGS=1 env var support in Makefile

Stability Verification

5 consecutive CI reruns — ALL PASSED ✅

Run 1: ✅ PASS  (31929716065)
Run 2: ✅ PASS
Run 3: ✅ PASS
Run 4: ✅ PASS
Run 5: ✅ PASS

Previous 10-rerun test (before the config race fix) showed 6/10 pass
(60%). After the port 9119 health check fix: 5/5 pass (100%).

Files Changed (7 files, +83 / -49 lines)

File	Change
.github/workflows/docker-publish.yml	Port 9119 wait, dev/prod parity
docker/Dockerfile	Remove dead stamp mechanism
docker/start-hermes.sh	--skip-build flag
docker/self-check.sh	Ollama checks, exit code fix
docker/01-copy-web-ui-stamp.sh	Deleted (dead code)
Makefile	NO_LOGS=1 support
docker/start-omniroute.sh	Model update

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.