Pin and package the released Hermes–Relay–Switchyard compatibility set

Parent Epic: #7937

Canonical NemoClaw scope was accepted in #7937 on 2026-08-13. This work item is blocked on one released compatibility tuple.

## Outcome

NemoClaw pins and packages one released, mutually compatible Hermes, NeMo Relay, Switchyard, and nvidia.switchyard plugin set for every supported Hermes sandbox architecture. Routing remains disabled by default in this work item.

## Current blocker — 2026-08-30

The native architecture is converging, but no complete released tuple exists:

- Hermes Agent 0.20.6 (`v2026.8.27`) contains the native in-process Relay loader from Hermes #77915, but the released version still requires `nemo-relay>=0.7.1,<0.8` and locks Relay 0.7.2. Hermes #96633 is now ready for review, requires and locks `nemo-relay>=0.8.1,<0.9`, adapts the typed tool-result and trace-propagation boundaries, and has green required CI on rebased head `c3e86f70`; it is not yet approved, merged, or released.
- Relay 0.8.1 is now the latest stable patch. Its signed annotated tag object `97cd439a` peels to commit `97466cd4`, and its immutable release carries digest-bearing Linux amd64 and arm64 assets. Relay #934 requires signed, trusted dynamic plugins at startup by default without changing the ABI or manifest schema. Hermes #96633 now locks Relay 0.8.1, so the source-level runtime tuple aligns; the complete released tuple remains blocked until that migration is approved, merged, and released, and the Switchyard bundle preserves Relay's default plugin-trust policy.
- Switchyard #537 is merged. Switchyard #528 is the current native-plugin integration, but it remains review-required and unreleased. Head `3b3c97b7` now bypasses decoding for unmanaged requests and moves the bundle-packaging regression into the normal test tree; the refreshed CI suite is green. Remaining reviews still include arbitrary inbound metadata-header forwarding, missing final streamed token usage, target request-policy validation, context-window failure classification, and focused interceptor/packaging coverage.
- Switchyard #528 has no published, digest-bearing Linux amd64 or arm64 plugin bundles, release-producer provenance, or accepted signing/trust evidence for Relay 0.8.1's secure default. Its documented Relay record must also converge with the manifest-backed activation path used by Hermes.
- Switchyard #271 closed unmerged. An accepted successor or equivalent released proof is required for redirect rejection, transport/body/SSE bounds, and diagnostic redaction.

Do not use PR overlays, moving branches, source builds, release candidates, or the frozen demo commit as production selectors.

## Scope

- Audit every crossed Hermes, Relay, and Switchyard release contract from the current NemoClaw pins.
- Pin exact release tags, source commits, package versions, archive/image digests, installed binary digests, plugin manifest identity, and schema identity.
- Prove that the selected Hermes lock resolves the exact selected stable Relay version and that Relay satisfies the released plugin manifest range and native API.
- Require independently released, signed plugin bundles for Linux amd64 and arm64, each bound to its producer repository, tag commit, workflow run and attempt, successful conclusion, archive digest, installed-library digest, and accepted Relay trust evidence.
- Install the released plugin bundle without leaving source trees, compilers, or plugin build tooling in the final image.
- Verify license, notice, SBOM, advisory, and producer-provenance coverage for the resolved dependency closure.
- Prove ordinary supervised Hermes behavior is unchanged when no routing configuration is supplied.
- Remove the demo-only Hermes source overlays, forced Relay prerelease wheel, and Switchyard source-build stage only after their exact released replacements pass the migration audit.

## Structural readiness record

Before changing any production selector, record one candidate tuple with:

- stable Hermes, Relay, and Switchyard versions and immutable release URLs;
- Hermes source/archive identity and the Relay version selected by its lock;
- Relay source identity plus released artifacts for Linux amd64 and arm64;
- Switchyard source identity plus nvidia.switchyard plugin ID, native API, Relay compatibility range, and disabled default;
- released plugin archives for Linux amd64 and arm64; and
- successful producer evidence bound to every consumed native artifact.

A structurally valid record opens the semantic migration audit. It does not prove production readiness or authorize an active selector, activation, merge, or support claim.

## Acceptance

- [x] Maintainers accepted #7937 as canonical NemoClaw scope on 2026-08-13.
- [ ] One published compatibility tuple is documented and mutually consistent.
- [ ] Hermes selects the exact stable Relay release required by the tuple.
- [ ] Every consumed artifact is integrity-verified and bound to its successful producer release.
- [ ] Linux amd64 and arm64 plugin bundles are present, provenance-bound, and independently digest-verified before extraction and execution.
- [ ] The final image contains the expected Hermes, Relay, Switchyard plugin, manifest, schema, licenses, and notices.
- [ ] The final image contains no upstream source overlay or build-only toolchain added for the plugin.
- [ ] Default Hermes startup and model calls remain unchanged with routing disabled.
- [ ] Unsupported platform/version combinations fail during build or preflight with an actionable error.
- [ ] The final candidate is re-audited against its immutable tags and published assets rather than earlier PR-head evidence.

## Likely implementation surface

- agents/hermes/Dockerfile.base
- agents/hermes/Dockerfile
- agents/hermes/manifest.yaml
- scripts/update-hermes-agent.sh
- Hermes image/layout, updater, dependency-pin, artifact-provenance, and secret-boundary tests