Add hermes_mcp, the bridge between Hermes and the ROS graph

The MCP server is now a ROS node and the only way in or out, per the owner's
decision that ROS never leaves the robot. It serves MCP on the USB address only
with a bearer token, keeps the stable tool name look() (which waits for the next
camera frame, so it is never stale, and passes the camera's JPEG through), and
registers turn_head/head_position only when a head is fitted, which today it is
not. While an authenticated client is connected it republishes the agent
heartbeat on /hermes/state, so the face wakes on connect and sleeps about 40 s
after the client leaves; look() also makes the face squint.

The token is generated on the Pi into /etc/robot-mcp.env (root:hermes, 640) and
never printed. Verified end to end from talos with a real MCP client over the USB
link: tools listed, a 157 KB JPEG back in 0.08 s, a wrong token refused, the Wi-Fi
path dropped by the firewall. Host config snippets now point at 10.55.0.2.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs

omarchy/50-robot-tunnel.conf

@@ -1,8 +1,8 @@
 # ~/.config/pipewire/pipewire.conf.d/50-robot-tunnel.conf  (on Omarchy)
 #
 # Makes the robot's speaker and microphone appear here as ordinary audio devices,
-# "Robot speaker" and "Robot microphone". Replace ROBOT_IP with the Pi's address
-# (give it a DHCP reservation on your router so it never changes).
+# "Robot speaker" and "Robot microphone". The robot is 10.55.0.2 on the USB link, a fixed address;
+# the robot's firewall accepts port 4713 only over that link, from 10.55.0.1.
 #
 # Apply with:  systemctl --user restart pipewire pipewire-pulse wireplumber
 
@@ -10,7 +10,7 @@ context.modules = [
     {   name = libpipewire-module-pulse-tunnel
         args = {
             tunnel.mode          = sink
-            pulse.server.address = "tcp:ROBOT_IP:4713"
+            pulse.server.address = "tcp:10.55.0.2:4713"
             #pulse.device        = "robot_ec_sink"     # only with the Pi's optional echo-cancel config
             pulse.latency        = 200                 # ms; lower is snappier but may crackle on weak Wi-Fi
             reconnect.interval.ms = 5000               # keep retrying while the robot is off
@@ -23,7 +23,7 @@ context.modules = [
     {   name = libpipewire-module-pulse-tunnel
         args = {
             tunnel.mode          = source
-            pulse.server.address = "tcp:ROBOT_IP:4713"
+            pulse.server.address = "tcp:10.55.0.2:4713"
             #pulse.device        = "robot_ec_source"   # only with the Pi's optional echo-cancel config
             pulse.latency        = 200
             reconnect.interval.ms = 5000