Add hermes-enhancement/: pi-style behavioral enhancement for Hermes agents

Self-service enhancement package for Hermes agents to adopt pi-style
conduct quality. Contains:
- prompts/behavioral-core.md: Distilled Three Pillars (~800 tokens)
- config/compression.yaml: 256K model optimization (80% threshold)
- config/mcp-servers.yaml: Tool parity (Context7, GitHub, Firecrawl, etc.)
- skills/: On-demand skills for conduct, verification, self-healing
- CHECKLIST-POC.md: Tanko POC verification checklist

POC pilot: Tanko

hermes-enhancement/skills/self-healing.md

@@ -0,0 +1,67 @@
+---
+name: self-healing
+description: Error recovery patterns for Hermes agents. Diagnose, fix, and learn from failures without user involvement.
+---
+
+# Self-Healing — Error Recovery
+
+## Step 1: Diagnose
+
+When you hit an error, read the full error message. Check:
+- Logs (systemd journal, app logs, container logs)
+- Exit codes and stack traces
+- Recent changes (what did you just modify?)
+- Dependencies (are services reachable?)
+
+## Step 2: Fix
+
+Try approaches in order:
+1. **Rollback** — restore the last known-good state from backup
+2. **Alternative** — different tool, different approach, different angle
+3. **Workaround** — skip the failing step, achieve the goal another way
+4. **Online search** — Context7 docs, GitHub issues, web search
+5. **Knowledge graph** — has another agent solved this before?
+
+## Step 3: Learn
+
+After fixing:
+- Log the lesson to the knowledge graph as `[LEARN] <insight>`
+- Include: symptom, root cause, fix, and how to detect early next time
+
+## Step 4: Continue
+
+Only involve the user if:
+- You've exhausted all approaches above
+- The fix requires credentials or permissions you don't have
+- The failure changes the scope or timeline of the original request
+
+When you do ask, present:
+```
+What happened: [one-line summary]
+What I tried: [3-4 approaches]
+What I need: [specific ask — credentials, permission, decision]
+```
+
+## Recovery Patterns
+
+### "Connection refused" / Service unreachable
+- Is the service running? `systemctl status` or `docker ps`
+- Is the port correct? Check configs
+- Is the firewall blocking? Check nftables/iptables
+- Is DNS resolving? `nslookup` or `dig`
+
+### "Permission denied"
+- Do you need sudo?
+- Is the file owned by another user?
+- Is SELinux/AppArmor blocking?
+- Is the filesystem read-only?
+
+### "Command not found"
+- Is the package installed?
+- Is it in PATH?
+- Is it a typo? Check the exact spelling.
+
+### "Config syntax error"
+- Validate with the tool's built-in check: `nginx -t`, `python3 -m py_compile`, `docker compose config`
+- Check for invisible characters (copy-paste artifacts)
+- Verify indentation (YAML/Python)