feat(operations): port Operations screen, wire to Hermes profiles + jobs

- Port clawsuite Operations module (screens/agents/*) — 265-line operations-screen,
  8 components, 2 hooks, agent presets.
- Route /operations now renders OperationsScreen (was gateway AgentsScreen).
- Each Hermes profile = one Operations agent. use-operations.ts talks to
  /api/profiles/{list,create,update,delete}. Default profile shown as 'Workspace'.
- New server fn updateProfileConfig + /api/profiles/update endpoint.
- cron-api.ts rewired to /api/hermes-jobs (was /api/cron/*). Friendly croniter
  missing-dep hint.
- New /api/session-history + /api/session-send adapters so the embedded
  ControlSuite chat components work against Hermes (/api/history + /api/send-stream).
- ChatScreen gains 'embedded' prop that disables auto-navigation side effects
  so the real chat can be embedded in Operations orchestrator without yanking
  users to /chat/$sessionKey on refresh/send.
- New Agent modal: template picker (Sage/Builder/Scribe/Ops/Trader/Blank) that
  pre-fills emoji + description + system prompt from agent-presets.
- Surface pass for hermes-nous dark theme: swapped literal bg-white ->
  bg-[var(--theme-card)] across all agents components (6 files).
- Stub src/hooks/use-agent-outputs.ts (clawsuite had dangling import; returns
  empty list for now — outputs feed backend TBD).
- install.sh: handle PEP 668 (Debian 12+/Ubuntu 23.04+) via pipx-first,
  venv-fallback. Include [cron] extra so hermes-agent has croniter.

install.sh

@@ -74,11 +74,52 @@ green "  pnpm $(pnpm --version) ✓"
 # ─── install hermes-agent (vanilla, no fork) ──────────────────────────────
 
 cyan "→ Installing hermes-agent (vanilla from PyPI)…"
-if ! python3 -c "import project_agent" &>/dev/null; then
-  python3 -m pip install --user --upgrade hermes-agent
-  green "  hermes-agent installed ✓"
-else
+if python3 -c "import project_agent" &>/dev/null; then
   green "  hermes-agent already installed ✓"
+else
+  # Detect PEP 668 environments (Debian 12+, Ubuntu 23.04+, recent Fedora, etc.)
+  is_externally_managed() {
+    python3 - <<'PY' 2>/dev/null
+import sys, sysconfig, pathlib
+p = pathlib.Path(sysconfig.get_paths()["stdlib"]).parent / "EXTERNALLY-MANAGED"
+sys.exit(0 if p.exists() else 1)
+PY
+  }
+
+  install_with_pipx() {
+    if ! command -v pipx &>/dev/null; then return 1; fi
+    pipx install --force "hermes-agent[cron]" && pipx ensurepath >/dev/null 2>&1
+  }
+
+  install_with_venv() {
+    local venv_dir="$HOME/.local/share/hermes-agent/venv"
+    local bin_dir="$HOME/.local/bin"
+    yellow "  Creating isolated venv at $venv_dir"
+    python3 -m venv "$venv_dir"
+    "$venv_dir/bin/pip" install --upgrade pip >/dev/null
+    "$venv_dir/bin/pip" install --upgrade "hermes-agent[cron]"
+    mkdir -p "$bin_dir"
+    ln -sf "$venv_dir/bin/project-agent" "$bin_dir/project-agent" 2>/dev/null || true
+    ln -sf "$venv_dir/bin/hermes-agent" "$bin_dir/hermes-agent" 2>/dev/null || true
+    case ":$PATH:" in
+      *":$bin_dir:"*) ;;
+      *) yellow "  Add to your shell rc: export PATH=\"$bin_dir:\$PATH\"" ;;
+    esac
+  }
+
+  if is_externally_managed; then
+    yellow "  PEP 668 environment detected (system Python is externally managed)"
+    if install_with_pipx; then
+      green "  hermes-agent installed via pipx ✓"
+    else
+      yellow "  pipx not available — falling back to isolated venv"
+      install_with_venv
+      green "  hermes-agent installed in venv ✓"
+    fi
+  else
+    python3 -m pip install --user --upgrade "hermes-agent[cron]"
+    green "  hermes-agent installed ✓"
+  fi
 fi
 
 # ─── clone workspace ──────────────────────────────────────────────────────