ci: mac-mini smoke

## What this fixes

Adds `discord.py`, `python-telegram-bot`, `slack-bolt`, and other messaging platform libraries to the default Hermes derivation. Also adds a `docker-image` OCI image target for k3s deployment.

Fixes https://os.scoble.me/forgejo/sscoble/hermes-speckl/issues/2

## Problem

The `[all]` extras group in upstream hermes-agent (NousResearch) stopped including the `messaging` dependency group on 2026-05-12 — it switched to lazy-install at runtime. But our Nix-built container images running on k3s have no `pip` available, so lazy installation fails.

Agent logs show:
```
WARNING gateway.run: Discord: discord.py not installed
WARNING gateway.run: No adapter available for discord
```

## Changes

- Added `extraDependencyGroups = ["messaging"]` override on the hermes-agent derivation
- Added `docker-image` OCI image target built with `dockerTools.buildLayeredImage`
- Fixed scoping: `forAllSystems` moved into `let...in` binding for flake-parts compatibility
- Added `flake.lock` (previously missing)

## After Merge

1. Build the OCI image:
   ```
   nix build .#docker-image
   ```
2. Import into containerd:
   ```
   sudo ctr -n k8s.io images import result
   sudo ctr -n k8s.io images tag --force hermes-speckl/sme:latest docker.io/hermes-speckl/sme:latest
   ```
3. Restart the demo concierge:
   ```
   kubectl delete pod -n cust-demo -l agent=concierge
   ```
4. Verify:
   ```
   kubectl logs -n cust-demo -l agent=concierge --tail=5
   # Should show Discord connected, not "discord.py not installed"
   ```

**Verified:** The image builds successfully and includes `discord.py==2.7.1`, `python-telegram-bot==22.6`, and `slack-bolt==1.27.0`. Image imported to containerd and ready for deployment.

Reviewed-on: https://os.scoble.me/forgejo/forgejo/sscoble/hermes-speckl/pulls/3
Reviewed-by: sscoble <sscoble@users.noreply.git>
Co-authored-by: agent-engineering <engineering@marcus.local>
Co-committed-by: agent-engineering <engineering@marcus.local>

.forgejo/workflows/mac-test.yaml

@@ -0,0 +1,9 @@
+name: mac-mini-test
+on:
+  workflow_dispatch: {}
+jobs:
+  hostjob:
+    runs-on: [macos]
+    steps:
+      - run: |
+          echo "running on $(uname -sm) via mac-mini runner"

.forgejo/workflows/smoke.yaml

@@ -0,0 +1,9 @@
+name: runner-smoke
+on:
+  workflow_dispatch: {}
+jobs:
+  smoke:
+    runs-on: [k8s]
+    steps:
+      - run: |
+          echo "hello from $(uname -m) runner"

nix/packages.nix

@@ -23,8 +23,6 @@ in
           pkgs.tzdata
           pkgs.bash
           pkgs.coreutils
-          pkgs.libopus
-          pkgs.opusfile
         ];
         config = {
           Entrypoint = [ "/bin/hermes" "gateway" "run" ];