fix(hermes-webui): hermes-agent main container non-root (UID/GID 1000)

- Aligns with webui sidecar on shared hermes-data PVC (/opt/data == /home/hermeswebui/.hermes)
- Previously root:root files blocked webui writes (whoami non-fatal)
- Pod securityContext: runAsNonRoot: true + runAsUser: 1000 for restricted:latest compliance
- fsGroup:1000 ensures volume g+rw

apps/base/customer1/hermes-agent/deployment.yaml

@@ -14,8 +14,10 @@ spec:
         app: hermes-agent
     spec:
       securityContext:
-        fsGroup: 1000
+        runAsNonRoot: true
         runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       containers:
       - name: hermes-agent
         securityContext:
@@ -23,8 +25,8 @@ spec:
           capabilities:
             drop:
             - ALL
-          runAsUser: 0
-          runAsGroup: 0
+          runAsUser: 1000
+          runAsGroup: 1000
           seccompProfile:
             type: RuntimeDefault
         image: nousresearch/hermes-agent:latest