refactor: align openclaw and hermes with their official Docker guides

hermes/compose.yml

@@ -1,6 +1,6 @@
 services:
   hermes:
-    build: .
+    image: nousresearch/hermes-agent:latest
     restart: unless-stopped
     command: gateway run
     environment:
@@ -9,27 +9,20 @@ services:
       - HERMES_DASHBOARD_BASIC_AUTH_USERNAME=${HERMES_DASHBOARD_USERNAME:-hermes}
       - HERMES_DASHBOARD_BASIC_AUTH_PASSWORD=${HERMES_DASHBOARD_PASSWORD:?required}
       - HERMES_DASHBOARD_BASIC_AUTH_SECRET=${HERMES_DASHBOARD_SECRET:?required}
-      - HERMES_UID=1000
-      - HERMES_GID=1000
-      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
-      - HERMES_WRITE_SAFE_ROOT=/opt/data:/workspace
-      - TERMINAL_CWD=/workspace
       - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
       - TELEGRAM_ALLOWED_USERS=${TELEGRAM_ALLOWED_USERS:-}
       - TELEGRAM_GROUP_ALLOWED_CHATS=${TELEGRAM_GROUP_ALLOWED_CHATS:-}
+      # - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
       # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
       # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
       # - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}
     volumes:
       - hermes-data:/opt/data
-      - hermes-workspace:/workspace
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9119/api/status"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 60s
+    deploy:
+      resources:
+        limits:
+          memory: 4G
+          cpus: "2.0"
 
 volumes:
   hermes-data:
-  hermes-workspace: