fix(hermes): wire all three contracts to reachability helper

The helper was correct but dead code - nothing called it. This commit:
1. Makes the helper runnable standalone: scripts/hermes-reachability-check.sh <host> <pattern> <path>
2. Wires all THREE contracts to it:
   - hermes-key-enforcement.prose.md
   - hermes-config-template.prose.md
   - hermes-agent-baseline.prose.md
3. Each contract now explicitly instructs to run the helper and interpret the three outcomes
4. States that the bug this replaces was deriving reachability from the remote grep's exit code

Files changed (4):
- scripts/hermes-reachability-check.sh (standalone mode added)
- hermes-key-enforcement.prose.md (reachability section added)
- hermes-config-template.prose.md (reachability section added)
- hermes-agent-baseline.prose.md (reachability section added)

scripts/hermes-reachability-check.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
 # Shared helper for Hermes contract reachability checks
 # Separates SSH exit status from remote command result
-# Pattern: remote side always succeeds, so ssh status = connection status only
 
 hermes_check_host() {
     local host=$1
@@ -21,3 +20,13 @@ hermes_check_host() {
         echo "$host: COMPLIANT (no matches found)"
     fi
 }
+
+# Standalone mode: scripts/hermes-reachability-check.sh <host> <pattern> <path>
+if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
+    if [ $# -ne 3 ]; then
+        echo "Usage: $0 <host> <pattern> <path>" >&2
+        exit 2
+    fi
+    hermes_check_host "$1" "$2" "$3"
+    exit 0
+fi