Move Hermes config into volume, add pre-deploy sync check

Config.yaml was bind-mounted, blocking runtime writes (/sethome).
Move it into the Docker volume via docker cp instead. Add
hermes-sync Makefile target that diffs remote config against local
before deploying, to catch runtime changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/ansible/playbook.yml

@@ -344,13 +344,17 @@
         mode: '0640'
       tags: hermes
 
-    - name: Copy Hermes config.yaml
+    - name: Stage Hermes config.yaml
       copy:
         src: ../hermes/config.yaml
         dest: /opt/hermes/config.yaml
         owner: root
         group: root
         mode: '0640'
+      tags: hermes
+
+    - name: Copy config.yaml into Hermes volume
+      command: docker cp /opt/hermes/config.yaml hermes:/opt/data/config.yaml
       notify: Restart Hermes
       tags: hermes