fix: bound Hermes workers session retention

[ssdavidai]

Fixes GH #241.

What changed:

• Adds a Hermes supervisor side loop that runs hourly and prunes stale profiles/*/sessions/* artifacts after a default 2-day retention window.
• Adds best-effort workers state.db maintenance: WAL checkpoint, optimize, and VACUUM with a short SQLite timeout so live gateways are never killed by cleanup.
• Adds an 80% disk-usage alert path via ctrl-api /api/v1/notifications, with six-hour cooldown.
• Documents the hermes_data retention runbook in CLAUDE.md.
• Adds focused regression tests for pruning, SQLite maintenance, disk-alert cooldown, and image/supervisor wiring.

Verification:

• git diff --check
• python3 -m py_compile packages/hermes/docker/hermes-session-maintenance.py packages/hermes/tests/test_session_maintenance.py
• bash -n packages/hermes/docker/supervisor.sh
• Python smoke test covering stale-session prune and workers state.db maintenance

Note: local environment did not have pytest installed, so the pytest file was syntax-checked and the core helper paths were smoke-tested directly.