Add real TCP reachability probe alongside DNS resolution (distinguish DNS-blocked from network-egress-blocked)

Replace placeholder Gradio app with HermesFace (Hermes Agent) Docker deployment