infra: pin hermes, add llamacpp backend + pinned agent Dockerfiles

- hermes: pin nousresearch/hermes-agent:v2026.8.18 (was :latest, a
  rolling dev build that Watchtower never re-pulled -> 7 weeks stale).
- llamacpp: add compose for the llama.cpp inference backend serving
  hermes on .150:8081 (q8_0 KV cache; 2.4x ollama on the same GGUF).
- ai-agents: add reconstructed, version-pinned Dockerfiles for margaret
  and spirit (openclaw was built from @latest with no Dockerfile stored).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compose/hf-pdocker-01/ai-agents/margaret/Dockerfile

@@ -0,0 +1,35 @@
+# Margaret — OpenClaw gateway agent (hf-pdocker-01, :18790)
+#
+# Reconstructed 2026-08-20 from the layer history of margaret-openclaw:latest;
+# the original Dockerfile was never committed anywhere.
+#
+# OPENCLAW_VERSION is pinned on purpose. This image was previously built with
+# `openclaw@latest`, which is how it sat on 2026.5.27 for months without anyone
+# noticing (same failure mode as the matrixdotorg/synapse :latest rot).
+# Bump this ARG deliberately.
+FROM node:22.22.3-bookworm
+
+ARG OPENCLAW_VERSION=2026.7.1-2
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g openclaw@${OPENCLAW_VERSION} 2>&1 | tail -5
+
+# The bundled matrix extension ships without its runtime deps installed.
+RUN if [ -d /usr/local/lib/node_modules/openclaw/dist/extensions/matrix ]; then \
+      cd /usr/local/lib/node_modules/openclaw/dist/extensions/matrix && \
+      npm install --no-fund --no-audit 2>&1 | tail -5; \
+    fi
+
+# Shim for a plugin-sdk export path some builds omit.
+RUN if [ ! -f /usr/local/lib/node_modules/openclaw/dist/plugin-sdk/keyed-async-queue.js ]; then \
+      printf 'export { KeyedAsyncQueue, enqueueKeyedTask } from "./index.js";\n' \
+        > /usr/local/lib/node_modules/openclaw/dist/plugin-sdk/keyed-async-queue.js; \
+    fi
+
+USER node
+WORKDIR /home/node
+EXPOSE 18790
+CMD ["openclaw", "gateway", "start", "--foreground"]

compose/hf-pdocker-01/ai-agents/spirit/Dockerfile

@@ -0,0 +1,38 @@
+# Spirit — OpenClaw infra-ops agent (hf-pdocker-01, :18795)
+#
+# Reconstructed 2026-08-20 from the layer history of spirit-ops:latest;
+# the original Dockerfile was never committed anywhere.
+#
+# OPENCLAW_VERSION is pinned on purpose. This image was previously built with
+# `openclaw@latest`, which is how it sat on 2026.5.27 for months without anyone
+# noticing (same failure mode as the matrixdotorg/synapse :latest rot).
+# Bump this ARG deliberately.
+FROM node:22.22.3-bookworm
+
+ARG OPENCLAW_VERSION=2026.7.1-2
+
+# spirit does infra ops: needs ssh out to the nodes plus basic diagnostics.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git ca-certificates openssh-client curl jq procps net-tools \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g openclaw@${OPENCLAW_VERSION} 2>&1 | tail -5
+
+RUN npm install -g @google/gemini-cli 2>&1 | tail -3
+
+# The bundled matrix extension ships without its runtime deps installed.
+RUN if [ -d /usr/local/lib/node_modules/openclaw/dist/extensions/matrix ]; then \
+      cd /usr/local/lib/node_modules/openclaw/dist/extensions/matrix && \
+      npm install --no-fund --no-audit 2>&1 | tail -5; \
+    fi
+
+# Shim for a plugin-sdk export path some builds omit.
+RUN if [ ! -f /usr/local/lib/node_modules/openclaw/dist/plugin-sdk/keyed-async-queue.js ]; then \
+      printf 'export { KeyedAsyncQueue, enqueueKeyedTask } from "./index.js";\n' \
+        > /usr/local/lib/node_modules/openclaw/dist/plugin-sdk/keyed-async-queue.js; \
+    fi
+
+USER node
+WORKDIR /home/node
+EXPOSE 18795
+CMD ["openclaw", "gateway", "start", "--foreground"]