nightly: drop Hermes variant (deprecated upstream)

[chaodu-agent]

What this PR does

Removes the hermes variant from the nightly image channel. openab retired
Hermes agent support and dropped it from all upstream CI in
openabdev/openab#1523 — the pre-beta-hermes base this channel builds FROM is
no longer maintained, and the flaky installer fetch that motivated the
retirement lived in this lane too.

Changes

• .github/workflows/nightly-images.yml
  • hermes removed from both the build and merge matrices
  • the Hermes release/commit resolver case removed, along with the
    github_api helper, the GH_TOKEN env (both existed only for Hermes's
    authenticated Contents API fetch), and the fail-closed
    .nightly-hermes-install.sh placeholder
  • CLI_REF plumbing removed end-to-end (resolver validation/output, both
    build-args blocks, smoke-test env) — Hermes was its only consumer
  • the Hermes smoke-test case removed
• Dockerfile.nightly
  • hermes-installer scratch stage, its RUN bind-mount, the hermes) install
    case, and the CLI_REF ARG removed
• .gitignore: .nightly-hermes-install.sh entry removed (nightly-only artifact)

Intentionally out of scope

image.yml (release channel) and NOTICE still list hermes — the published
pre-beta-hermes / beta-hermes base tags still exist (frozen), so that
channel keeps working for now. Removing it there is a separate decision.

Verification

• Zero hermes / CLI_REF / github_api references remain in
  nightly-images.yml, Dockerfile.nightly, .gitignore
• nightly-images.yml parses as valid YAML
• This PR itself exercises the nightly lane: the workflow's pull_request
  paths trigger covers both changed files, so the matrix build + smoke test
  run on this PR

Diffstat: 3 files, +5 / −86.