straylight: add tirith (Hermes pre-exec command scanner)

Hermes resolves tirith from PATH before its self-downloaded
~/.hermes/bin/tirith. Taken from nixpkgs-unstable (0.4.1); nixos-26.05
only has 0.3.3.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

hw/straylight/default.nix

@@ -333,6 +333,10 @@ in
       llamaUnloadCmd
       whisperTranscribe
       whisperCpp
+      # tirith: pre-exec command security scanner used by Hermes (resolved from
+      # PATH before its self-downloaded ~/.hermes/bin/tirith). From unstable:
+      # 26.05 only has 0.3.3, Hermes ships 0.4.x.
+      pkgsUnstable.tirith
     ];
 
     services.open-webui = {