Allow local-only scheduled Hermes agents

[mostlydev]

Closes #365.

What changed

• allow Hermes services with no chat handles when they declare at least one scheduled invocation and every invocation uses local delivery
• continue rejecting handle-less services with no invocation
• reject any handle-less invocation that supplies a routed to target
• make the local-delivery jobs test exercise the zero-handle case directly

Why

Hermes validation required Discord, Slack, or Telegram even for scheduler-owned background agents whose results stay local. That forced isolated jobs to acquire a fake chat identity and credentials despite having no chat surface.

The new exception is deliberately narrow and fail-closed: it applies only to scheduled, unrouted work. Interactive and routed services retain the existing handle and token requirements.

Validation

• go test ./internal/driver/hermes ./internal/pod ./cmd/claw
• live Tiverton smoke with a local-only scheduled Hermes service: materialization and post-apply verification passed, the gateway made no Discord login attempt, and the container healthcheck remained healthy

[mostlydev]

Desk follow-up validation on 2026-08-12: the exact patch also passes go test ./... on top of the v0.28.1 release commit. Independent review reconfirmed the boundary is fail-closed: zero handles requires at least one invocation, every to must be blank, and routed configurations remain rejected.