fix: adapt to hermes-agent s6-overlay migration

refactor: switch to /opt/data (local disk) like HuggingMes upstream

fix: kanban readonly + session DB permission after restore

fix: symlink entire sessions/ dir to local disk

fix: comprehensive FUSE compatibility + reduce backup rate

fix: symlink state.db to local disk — SQLite incompatible with FUSE

fix: SQLite readonly + resolv.conf permission errors

fix: entrypoint wrapper creates /data/hermes before base image drops root