Move Hermes config into volume, add pre-deploy sync check

Config.yaml was bind-mounted, blocking runtime writes (/sethome).
Move it into the Docker volume via docker cp instead. Add
hermes-sync Makefile target that diffs remote config against local
before deploying, to catch runtime changes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/hermes/docker-compose.yml

@@ -13,7 +13,6 @@ services:
       - monotrope
     volumes:
       - hermes_data:/opt/data
-      - ./config.yaml:/opt/data/config.yaml:ro
       - ./plugins:/opt/data/plugins:ro
     environment:
       OPENROUTER_API_KEY: "${OPENROUTER_API_KEY}"