fix: include messaging dependency group in default Hermes build (#3)

## What this fixes

Adds `discord.py`, `python-telegram-bot`, `slack-bolt`, and other messaging platform libraries to the default Hermes derivation. Also adds a `docker-image` OCI image target for k3s deployment.

Fixes https://os.scoble.me/forgejo/sscoble/hermes-speckl/issues/2

## Problem

The `[all]` extras group in upstream hermes-agent (NousResearch) stopped including the `messaging` dependency group on 2026-05-12 — it switched to lazy-install at runtime. But our Nix-built container images running on k3s have no `pip` available, so lazy installation fails.

Agent logs show:
```
WARNING gateway.run: Discord: discord.py not installed
WARNING gateway.run: No adapter available for discord
```

## Changes

- Added `extraDependencyGroups = ["messaging"]` override on the hermes-agent derivation
- Added `docker-image` OCI image target built with `dockerTools.buildLayeredImage`
- Fixed scoping: `forAllSystems` moved into `let...in` binding for flake-parts compatibility
- Added `flake.lock` (previously missing)

## After Merge

1. Build the OCI image:
   ```
   nix build .#docker-image
   ```
2. Import into containerd:
   ```
   sudo ctr -n k8s.io images import result
   sudo ctr -n k8s.io images tag --force hermes-speckl/sme:latest docker.io/hermes-speckl/sme:latest
   ```
3. Restart the demo concierge:
   ```
   kubectl delete pod -n cust-demo -l agent=concierge
   ```
4. Verify:
   ```
   kubectl logs -n cust-demo -l agent=concierge --tail=5
   # Should show Discord connected, not "discord.py not installed"
   ```

**Verified:** The image builds successfully and includes `discord.py==2.7.1`, `python-telegram-bot==22.6`, and `slack-bolt==1.27.0`. Image imported to containerd and ready for deployment.

Reviewed-on: https://os.scoble.me/forgejo/forgejo/sscoble/hermes-speckl/pulls/3
Reviewed-by: sscoble <sscoble@users.noreply.git>
Co-authored-by: agent-engineering <engineering@marcus.local>
Co-committed-by: agent-engineering <engineering@marcus.local>

nix/packages.nix

@@ -1,10 +1,40 @@
 { inputs, ... }:
+let
+  forAllSystems = inputs.nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ];
+in
 {
   flake.packages = forAllSystems (system:
     let
       pkgs = inputs.nixpkgs.legacyPackages.${system};
+
+      # Hermes agent with messaging platform support (Discord, Slack, Telegram)
+      hermesMessaging = inputs.hermes-agent.packages.${system}.default.override {
+        extraDependencyGroups = [ "messaging" ];
+      };
+
+      # OCI container image for k3s deployment
+      hermesImage = pkgs.dockerTools.buildLayeredImage {
+        name = "hermes-speckl/sme";
+        tag = "latest";
+        created = "now";
+        contents = [
+          hermesMessaging
+          pkgs.cacert
+          pkgs.tzdata
+          pkgs.bash
+          pkgs.coreutils
+        ];
+        config = {
+          Entrypoint = [ "/bin/hermes" "gateway" "run" ];
+          Env = [
+            "PATH=/bin"
+            "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+          ];
+        };
+      };
     in {
-      default = inputs.hermes-agent.packages.${system}.default;
+      default = hermesMessaging;
+      docker-image = hermesImage;
 
       speckl-config = pkgs.writeTextDir "speckl-config.yaml" ''
         # Speckl SME — generated config
@@ -20,7 +50,4 @@
       '';
     }
   );
-
-  # Helper: build for the standard platforms
-  forAllSystems = inputs.nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ];
 }