feat(daimon): multi-user Discord support bot with tiered access control

Complete implementation of Daimon — Discord support bot for Nous Research:

Core features:
- Role-based tier resolution (admin via Discord roles/user_ids, user tier for everyone else)
- Punctuation-based message windowing (@mention triggers flush of accumulated context)
- Per-thread turn cap (20 responses/thread for users, unlimited for admins)
- Docker sandbox isolation (terminal commands execute in container)
- GitHub sidecar broker (agent never touches the PAT)
- SQLite persistence for thread ownership, turn counts, bans
- Message ID dedup (prevents double-processing on Discord network glitches)
- RTFM docs index skill (links relevant docs pages on how-to questions)

Modules (all new files — gateway/daimon/):
  config, tier, agent_overrides, gateway_hooks, discord_hooks,
  session_manager, thread_filter, concurrency, tool_gate, tool_limiter,
  window_buffer, persistence, redaction, workspace, admin_commands

Infrastructure (docker/daimon-sandbox/):
  Dockerfile, docker-compose, gh_broker.py, gh_client.py, entrypoint

Gateway integration (patches to existing files):
  - gateway/session.py: role_ids field on SessionSource
  - gateway/platforms/base.py: role_ids param in build_source()
  - gateway/platforms/discord.py: role population, daimon hooks, windowing
  - gateway/run.py: tier detection, overrides, tool gate, redaction, turns
  - run_agent.py: tool gate in _invoke_tool
  - hermes_cli/commands.py: /daimon CommandDef

tools/code_execution_tool.py

@@ -621,6 +621,8 @@ def _get_or_create_env(task_id: str):
                 "vercel_runtime": config.get("vercel_runtime", ""),
                 "docker_volumes": config.get("docker_volumes", []),
                 "docker_run_as_host_user": config.get("docker_run_as_host_user", False),
+                "docker_network": config.get("docker_network"),
+                "docker_exec_user": config.get("docker_exec_user"),
             }
 
         ssh_config = None