feat: extract sovereign work from hermes-agent fork into sidecar

Extracted 52 files from Timmy_Foundation/hermes-agent (gitea/main) into
hermes-sovereign/ directory to restore clean upstream tracking.

Layout:
  docs/             19 files — deploy guides, performance reports, security docs, research
  security/          5 files — audit workflows, PR checklists, validation scripts
  wizard-bootstrap/  7 files — wizard environment, dependency checking, auditing
  notebooks/         2 files — Jupyter health monitoring notebooks
  scripts/           5 files — forge health, smoke tests, syntax guard, deploy validation
  ci/                2 files — Gitea CI workflow definitions
  githooks/          3 files — pre-commit hooks and config
  devkit/            8 files — developer toolkit (Gitea client, health, notebook runner)
  README.md          1 file  — directory overview

Addresses: #337, #338

hermes-sovereign/scripts/syntax_guard.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+"""Syntax guard — compile all Python files to catch syntax errors before merge."""
+import py_compile
+import sys
+from pathlib import Path
+
+errors = []
+for p in Path(".").rglob("*.py"):
+    if ".venv" in p.parts or "__pycache__" in p.parts:
+        continue
+    try:
+        py_compile.compile(str(p), doraise=True)
+    except py_compile.PyCompileError as e:
+        errors.append(f"{p}: {e}")
+        print(f"SYNTAX ERROR: {p}: {e}", file=sys.stderr)
+
+if errors:
+    print(f"\n{len(errors)} file(s) with syntax errors", file=sys.stderr)
+    sys.exit(1)
+print("All Python files compile successfully")