Require --client SLUG on the one-liner; add hermes-client-provision for
isolated HERMES_HOME + hermes-gateway-<slug>. Document profile isolation
over per-VM/Docker for DomHubs fleet on a single host.
Document and force TELEGRAM_ALLOWED_USERS into ~/.hermes/.env (gateway
source of truth). Client creates bot via BotFather. install.sh defaults
conductor to hermes for a true single-command demo start.
PTY relay freezes prompt_toolkit after the first turn. Prefer a detached
tmux session, send short kickoff via send-keys, then attach. Keep PTY
as fallback when tmux is missing.
TUI HERMES_TUI_QUERY races session creation (~4s) and often never
submits. Default launcher now uses hermes chat --cli plus a small
Python PTY that injects the Phase-1 kickoff after ready markers.
