fix(hermes): give the agent's data volume its container's ownership on NFS

The agent runs as uid 10000 and keeps its kanban state in embedded
SQLite. Without an nfs block the export directory is created root:root,
no_root_squash helps only root, and uid 10000 gets EACCES, which SQLite
reports as "attempt to write a readonly database". Concurrent writers
would report "database is locked" instead, which is how the two apart.
Compose has no NFS bind, which is why only swarm failed.

An earlier series gave five other non-root roles the same block; this
role was the one left out.

replicas: 1 stays as hardening, not as the fix: once the writes land,
three replicas contend for one SQLite writer lock.

roles/web-app-hermes/meta/services.yml

@@ -6,6 +6,8 @@ hermes:
       enabled: true
     swarm:
       enabled: true
+  # nocheck: single-replica the agent keeps its kanban state in embedded SQLite on one shared volume, and SQLite takes a single writer lock per file, so concurrent replicas serialise into "database is locked" instead of sharing the work
+  replicas: 1
   bond: 1
   enabled: true
   shared: true

roles/web-app-hermes/meta/volumes.yml

@@ -1,6 +1,10 @@
 ---
 hermes_data:
   type: volume
+  nfs:
+    uid: "10000"
+    gid: "10000"
+    mode: "0770"
   mounts:
     - service: hermes
       target: /opt/data