Reconcile clean-render deployment state into main

[Emife1]

Summary

This PR reconciles the stale main branch with the deployment-ready state currently maintained on clean-render.

Why this is needed

The running Hermes deployment aligns with clean-render, while main contains an older entrypoint and omits the baked runtime configuration, Kubernetes manifests, CI workflow, and operational documentation. This divergence makes repository inspection misleading and creates a high risk of rebuilding an image from the wrong source.

Included from clean-render

• Production-compatible entrypoint.sh
• Baked render-config.yaml
• Updated Dockerfile and health server
• Kubernetes homelab manifests and verification scripts
• GHCR image workflow and Render keep-alive workflow
• Operational, memory, heartbeat, Telegram probe, and deployment documentation

Important review points

• Confirm render-config.yaml contains no credentials or secrets before merge.
• Confirm the configured Telegram allow-list and user-specific prompt content are intended to remain version-controlled.
• Validate the Docker image build and gateway startup path.
• Do not implement the proposed four-model routing chain in this PR until the installed Hermes configuration schema confirms support for multiple ordered fallbacks.
• Rotate any API key previously exposed outside the secret store.

Post-merge follow-up

• Treat main as the canonical image-build source.
• Pin deployments to immutable image digests and record the source commit.
• Remove or archive obsolete deployment branches after verification.
• Remove the unused OpenRouter secret reference separately if it still exists in the deployed manifests.