infra: pin hermes, add llamacpp backend + pinned agent Dockerfiles

- hermes: pin nousresearch/hermes-agent:v2026.8.18 (was :latest, a
  rolling dev build that Watchtower never re-pulled -> 7 weeks stale).
- llamacpp: add compose for the llama.cpp inference backend serving
  hermes on .150:8081 (q8_0 KV cache; 2.4x ollama on the same GGUF).
- ai-agents: add reconstructed, version-pinned Dockerfiles for margaret
  and spirit (openclaw was built from @latest with no Dockerfile stored).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/gpu-machine/hermes/docker-compose.yml

@@ -4,7 +4,11 @@
 # bridged bind mount). friday-voice calls this via `docker exec hermes hermes ...`.
 services:
   gateway:
-    image: nousresearch/hermes-agent:latest
+    # PINNED 2026-08-20. Was `:latest`, which on this repo is the same digest as
+    # `main` (a rolling dev build), and with Watchtower disabled nothing ever
+    # re-pulled it — the container sat on v2026.7.1 for ~7 weeks / 9 releases.
+    # Bump deliberately; rollback image: nousresearch/hermes-agent:rollback-2026.7.1
+    image: nousresearch/hermes-agent:v2026.8.18
     container_name: hermes
     restart: unless-stopped
     volumes: