feat: add OCI container image for k3s deployment

nix/packages.nix

@@ -6,12 +6,36 @@ in
   flake.packages = forAllSystems (system:
     let
       pkgs = inputs.nixpkgs.legacyPackages.${system};
-    in {
+
       # Hermes agent with messaging platform support (Discord, Slack, Telegram)
-      default = inputs.hermes-agent.packages.${system}.default.override {
+      hermesMessaging = inputs.hermes-agent.packages.${system}.default.override {
         extraDependencyGroups = [ "messaging" ];
       };
 
+      # OCI container image for k3s deployment
+      hermesImage = pkgs.dockerTools.buildLayeredImage {
+        name = "hermes-speckl/sme";
+        tag = "latest";
+        created = "now";
+        contents = [
+          hermesMessaging
+          pkgs.cacert
+          pkgs.tzdata
+          pkgs.bash
+          pkgs.coreutils
+        ];
+        config = {
+          Entrypoint = [ "/bin/hermes" "gateway" "run" ];
+          Env = [
+            "PATH=/bin"
+            "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+          ];
+        };
+      };
+    in {
+      default = hermesMessaging;
+      docker-image = hermesImage;
+
       speckl-config = pkgs.writeTextDir "speckl-config.yaml" ''
         # Speckl SME — generated config
         # Override via services.hermes-speckl.settings

result

@@ -0,0 +1 @@
+/nix/store/wmr5qjizys6dsbsrgvydc0c7ijx4inra-hermes-agent-0.13.0