Add hermes_mcp, the bridge between Hermes and the ROS graph

The MCP server is now a ROS node and the only way in or out, per the owner's
decision that ROS never leaves the robot. It serves MCP on the USB address only
with a bearer token, keeps the stable tool name look() (which waits for the next
camera frame, so it is never stale, and passes the camera's JPEG through), and
registers turn_head/head_position only when a head is fitted, which today it is
not. While an authenticated client is connected it republishes the agent
heartbeat on /hermes/state, so the face wakes on connect and sleeps about 40 s
after the client leaves; look() also makes the face squint.

The token is generated on the Pi into /etc/robot-mcp.env (root:hermes, 640) and
never printed. Verified end to end from talos with a real MCP client over the USB
link: tools listed, a 157 KB JPEG back in 0.08 s, a wrong token refused, the Wi-Fi
path dropped by the firewall. Host config snippets now point at 10.55.0.2.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs

omarchy/50-robot-tunnel.conf

@@ -1,8 +1,8 @@
 # ~/.config/pipewire/pipewire.conf.d/50-robot-tunnel.conf  (on Omarchy)
 #
 # Makes the robot's speaker and microphone appear here as ordinary audio devices,
-# "Robot speaker" and "Robot microphone". Replace ROBOT_IP with the Pi's address
-# (give it a DHCP reservation on your router so it never changes).
+# "Robot speaker" and "Robot microphone". The robot is 10.55.0.2 on the USB link, a fixed address;
+# the robot's firewall accepts port 4713 only over that link, from 10.55.0.1.
 #
 # Apply with:  systemctl --user restart pipewire pipewire-pulse wireplumber
 
@@ -10,7 +10,7 @@ context.modules = [
     {   name = libpipewire-module-pulse-tunnel
         args = {
             tunnel.mode          = sink
-            pulse.server.address = "tcp:ROBOT_IP:4713"
+            pulse.server.address = "tcp:10.55.0.2:4713"
             #pulse.device        = "robot_ec_sink"     # only with the Pi's optional echo-cancel config
             pulse.latency        = 200                 # ms; lower is snappier but may crackle on weak Wi-Fi
             reconnect.interval.ms = 5000               # keep retrying while the robot is off
@@ -23,7 +23,7 @@ context.modules = [
     {   name = libpipewire-module-pulse-tunnel
         args = {
             tunnel.mode          = source
-            pulse.server.address = "tcp:ROBOT_IP:4713"
+            pulse.server.address = "tcp:10.55.0.2:4713"
             #pulse.device        = "robot_ec_source"   # only with the Pi's optional echo-cancel config
             pulse.latency        = 200
             reconnect.interval.ms = 5000

omarchy/hermes-config-snippet.yaml

@@ -1,10 +1,14 @@
 # Merge these into ~/.hermes/config.yaml on Omarchy.
-# Put the token from the Pi's install.sh output in ~/.hermes/.env as:
-#     ROBOT_MCP_TOKEN=<64 hex characters>
+# The robot is at 10.55.0.2 on the USB link (the host is 10.55.0.1; see host/omarchy/robot-usb-link.sh).
+# Put the token in ~/.hermes/.env as:   ROBOT_MCP_TOKEN=<64 hex characters>
+# It lives only on the Pi, in /etc/robot-mcp.env (read it with: ssh hermes@10.55.0.2 sudo cat /etc/robot-mcp.env).
+# The robot's firewall accepts this port only over the USB link, from 10.55.0.1.
+# While Hermes holds a connection the robot's face is awake; when it stops, the face falls asleep after
+# about 40 seconds. A robot with no head fitted offers only look(); turn_head appears when servos do.
 
 mcp_servers:
   robot:
-    url: "http://ROBOT_IP:8765/mcp"
+    url: "http://10.55.0.2:8765/mcp"
     headers:
       Authorization: "Bearer ${ROBOT_MCP_TOKEN}"
     connect_timeout: 15