Require --client SLUG on the one-liner; add hermes-client-provision for
isolated HERMES_HOME + hermes-gateway-<slug>. Document profile isolation
over per-VM/Docker for DomHubs fleet on a single host.
Document and force TELEGRAM_ALLOWED_USERS into ~/.hermes/.env (gateway
source of truth). Client creates bot via BotFather. install.sh defaults
conductor to hermes for a true single-command demo start.
Long kickoff text tripped Hermes paste-collapse ([Pasted text #N]) and
broke Enter handling. Use a short single-line kickoff, inject once after
skill activation, and set raw mode so input stays inside Hermes.
TUI HERMES_TUI_QUERY races session creation (~4s) and often never
submits. Default launcher now uses hermes chat --cli plus a small
Python PTY that injects the Phase-1 kickoff after ready markers.
