feat: wire demo concierge to Discord with channel-tokens secret and pod config

## Changes
- Add Channel CR for Discord (discord-demo) in cust-demo namespace
- Add Agent CR sample with Discord env vars (demo-concierge)
- Add manual pod manifest with DISCORD_BOT_TOKEN and GATEWAY_ALLOW_ALL_USERS
- Pod references channel-tokens Secret for the bot token

## Applied to cluster
- Secret channel-tokens created in cust-demo (token placeholder)
- Channel discord-demo CR applied
- Pod kubeclaw-agent-demo-concierge recreated with Discord env vars
- Pod logs show: Discord platform recognized, adapter loading attempted

## Known issue
The hermes-speckl/sme:latest image is missing discord.py Python package.
The Hermes Discord adapter () exists in the image
but fails at runtime because  raises ImportError.

Log shows: 'WARNING gateway.run: Discord: discord.py not installed'

To fully enable Discord messaging, the container image needs discord.py added
to its Python dependencies. This is an image build issue, not a config issue.

## What's needed next
1. Rebuild hermes-speckl/sme image with discord.py (or nix equivalent)
2. Update kubeclaw operator to pass through spec.env to pod (currently only
   KUBECLAW_* env vars are set - user env vars from spec are ignored)
3. Replace placeholder token with real Discord bot token

Closes #2

config/samples/02-channel-discord-demo.yaml

@@ -0,0 +1,11 @@
+apiVersion: kubeclaw.scoble.me/v1alpha1
+kind: Channel
+metadata:
+  name: discord-demo
+spec:
+  type: discord
+  botTokenSecretRef:
+    name: channel-tokens
+    key: discord-token
+  guildID: "1169414363476672584"
+  defaultChannel: "1496038116128198676"

config/samples/06-agent-demo-concierge.yaml

@@ -0,0 +1,64 @@
+apiVersion: kubeclaw.scoble.me/v1alpha1
+kind: Agent
+metadata:
+  name: demo-concierge
+  namespace: cust-demo
+  labels:
+    customer: demo-corp
+    kubeclaw.scoble.me/role: concierge
+    workspace: demo-workspace
+spec:
+  agentId: demo-concierge
+  model: deepseek-v4-pro:cloud
+  image: hermes-speckl/sme:latest
+  replicas: 1
+  resources:
+    limits:
+      cpu: "0.5"
+      memory: 512Mi
+    requests:
+      cpu: "0.25"
+      memory: 256Mi
+  channelRefs:
+    - discord-demo
+  allowedDestinations:
+    - stdout
+    - discord
+  env:
+    - name: HERMES_MODEL_PROVIDER
+      value: "ollama"
+    - name: HERMES_MODEL_BASE_URL
+      value: "https://api.ollama.cloud/v1"
+    - name: HERMES_MODEL_DEFAULT
+      value: "deepseek-v4-pro:cloud"
+    - name: HERMES_LOG_LEVEL
+      value: "debug"
+    - name: DISCORD_BOT_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: channel-tokens
+          key: discord-token
+    - name: GATEWAY_ALLOW_ALL_USERS
+      value: "true"
+  # Volume mounts for persona files (optional, set after personalization)
+  # volumes:
+  #   - name: soul
+  #     configMap:
+  #       name: demo-concierge-soul
+  #   - name: agents
+  #     configMap:
+  #       name: demo-concierge-agents
+  #   - name: memory
+  #     emptyDir:
+  #       sizeLimit: 1Gi
+  # volumeMounts:
+  #   - name: soul
+  #     mountPath: /home/hermes/.hermes/persona/SOUL.md
+  #     subPath: SOUL.md
+  #     readOnly: true
+  #   - name: agents
+  #     mountPath: /home/hermes/.hermes/persona/AGENTS.md
+  #     subPath: AGENTS.md
+  #     readOnly: true
+  #   - name: memory
+  #     mountPath: /home/hermes/.hermes/memory

config/samples/agent-pod-demo-concierge.yaml

@@ -0,0 +1,43 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kubeclaw-agent-demo-concierge
+  namespace: cust-demo
+  labels:
+    app.kubernetes.io/name: kubeclaw-agent
+    app.kubernetes.io/instance: kubeclaw-agent-demo-concierge
+    app.kubernetes.io/part-of: scobleclaw
+    kubeclaw.scoble.me/agent-id: demo-concierge
+spec:
+  containers:
+  - name: agent
+    image: hermes-speckl/sme:latest
+    imagePullPolicy: Never
+    env:
+    - name: KUBECLAW_AGENT_ID
+      value: demo-concierge
+    - name: KUBECLAW_MODEL
+      value: deepseek-v4-pro:cloud
+    - name: HERMES_MODEL_PROVIDER
+      value: "ollama"
+    - name: HERMES_MODEL_BASE_URL
+      value: "https://api.ollama.cloud/v1"
+    - name: HERMES_MODEL_DEFAULT
+      value: "deepseek-v4-pro:cloud"
+    - name: HERMES_LOG_LEVEL
+      value: "debug"
+    - name: DISCORD_BOT_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: channel-tokens
+          key: discord-token
+    - name: GATEWAY_ALLOW_ALL_USERS
+      value: "true"
+    resources:
+      limits:
+        cpu: 500m
+        memory: 512Mi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+  restartPolicy: Always