chore(hermes): pin payments-enabled agent image

internal/agentcrd/agent_contract_integration_test.go

@@ -20,8 +20,8 @@ import (
 //
 // The unit tests in agent_test.go and serviceoffercontroller/agent_render_test.go
 // only prove that we *render* the `.no-bundled-skills` marker and the capped
-// hermes-config keys. They do NOT prove the Hermes image
-// (nousresearch/hermes-agent:v2026.6.5) actually honors them. v2026.5.28
+// hermes-config keys. They do NOT prove the currently pinned Hermes image
+// actually honors them. v2026.5.28
 // shipped the marker check on the install/CLI path only; the per-launch
 // sync_skills() call ignored it and re-seeded ~24 categories from the
 // image-baked /opt/hermes/skills source on every boot, regardless of the

internal/hermes/hermes.go

@@ -35,7 +35,7 @@ const (
 	rawChartVersion = "2.0.2"
 
 	// renovate: datasource=docker depName=nousresearch/hermes-agent
-	defaultImage = "nousresearch/hermes-agent:v2026.6.5"
+	defaultImage = "nousresearch/hermes-agent:main@sha256:e9f2892b626468d2a65abeae9f94ec0a71872d7d9643906b956ab29c9bf328a9"
 	// Use the upstream image venv instead of cloning Hermes into the PVC on
 	// every cold start. The init container below validates the required extras
 	// are present so image regressions fail before the gateway starts.

internal/serviceoffercontroller/agent_render.go

@@ -27,7 +27,7 @@ const (
 	hermesDataPVC      = "hermes-data"
 	hermesAPIPath      = "/health"
 	// renovate: datasource=docker depName=nousresearch/hermes-agent
-	defaultHermesImage = "nousresearch/hermes-agent:v2026.6.5"
+	defaultHermesImage = "nousresearch/hermes-agent:main@sha256:e9f2892b626468d2a65abeae9f94ec0a71872d7d9643906b956ab29c9bf328a9"
 )
 
 // agentLabels returns the standard label set we attach to every primitive