v0.7.1: install.sh survives boxes this one's assumptions did not fit

Two portability bugs, both found by pre-flighting a second machine (kdmirah,
a Debian LXC) rather than by reading the script again.

1. `systemctl` existing does not mean a user bus is reachable. Inside an LXC,
   over `su`, or with no logind session, `systemctl --user` fails with
   "Failed to connect to user scope bus". The old check asked whether the
   binary was on PATH, then ran `systemctl --user daemon-reload` under
   `set -euo pipefail` — so the install ABORTED halfway, after the venv and
   before the hermes wiring. It now asks the real question,
   `systemctl --user show-environment`, and on failure installs no units, says
   why (naming XDG_RUNTIME_DIR and the usual causes), prints the three
   commands to run by hand, and continues to hermes.

2. The hermes interpreter was hardcoded to this box's layout,
   /usr/local/lib/hermes-agent/venv/bin/python. kdmirah installs hermes under
   ~/.local/bin with its venv at ~/.hermes/hermes-agent/venv. Both are bash
   wrappers that exec their python, so the path is now read out of the wrapper
   (with a pip console-script shebang as the second shape). Verified against
   both machines: each derives its own interpreter and each reports mcp present.

Also: the closing summary no longer prints the dashboard URL and
`journalctl --user -u socialmag-refresh` when no units were installed. Pointing
someone at a journal for a unit that was never created is the same class of lie
as a silent fallback — it reads as working and answers with nothing.

Both branches fired in a sandbox with a fake HOME and two stub systemctls, one
that answers show-environment and one that refuses it. Both exit 0; the
refusing one installs nothing, warns loudly, and still registers hermes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

install.sh

@@ -62,9 +62,28 @@ ok "console scripts: socialmag, socialmag-refresh, socialmag-openbridge"
 # ---------------------------------------------------------------- systemd
 
 say "systemd user units"
-if ! command -v systemctl >/dev/null 2>&1; then
-  warn "systemctl not found — skipping units"
-  warn "run the three processes by hand: socialmag, socialmag-openbridge, and 'python -m http.server 8321' in $REPO"
+# systemctl being installed does NOT mean a user bus is reachable. Inside an LXC,
+# over `su`, or on a box with no logind session, `systemctl --user` fails with
+# "Failed to connect to user scope bus". Ask the real question — can we talk to
+# the user manager — instead of asking whether the binary exists.
+USER_BUS=""
+if command -v systemctl >/dev/null 2>&1 && systemctl --user show-environment >/dev/null 2>&1; then
+  USER_BUS="yes"
+fi
+
+if [[ -z "$USER_BUS" ]]; then
+  warn "no reachable systemd user bus — units NOT installed."
+  if ! command -v systemctl >/dev/null 2>&1; then
+    warn "reason: systemctl is not on PATH."
+  else
+    warn "reason: systemctl --user cannot reach a user manager (XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-unset})."
+    warn "common causes: an LXC without logind, a shell entered via su, or no lingering."
+    warn "  sudo loginctl enable-linger $USER   # then log in fresh and re-run"
+  fi
+  warn "until then, run the three by hand from $REPO:"
+  warn "  $VENV/bin/socialmag-openbridge &"
+  warn "  $VENV/bin/python -m http.server 8321 &"
+  warn "  $VENV/bin/socialmag-refresh           # one pass, whenever you want it"
 else
   mkdir -p "$UNIT_DIR"
   for src in "$REPO"/deploy/user/*.in; do
@@ -94,7 +113,23 @@ fi
 # ---------------------------------------------------------------- hermes
 
 say "Hermes MCP registration"
-HERMES_PY="/usr/local/lib/hermes-agent/venv/bin/python"
+
+# Hermes installs in more than one shape — /usr/local/bin/hermes wrapping a venv
+# under /usr/local/lib, or ~/.local/bin/hermes from a user install. Read the
+# interpreter out of the wrapper rather than hardcoding one box's layout.
+HERMES_PY=""
+if command -v hermes >/dev/null 2>&1; then
+  _hermes_bin="$(command -v hermes)"
+  if head -c 2 "$_hermes_bin" 2>/dev/null | grep -q '#!'; then
+    # A wrapper script: the python it exec's is the interpreter that loads MCP.
+    HERMES_PY="$(grep -oE '"[^"]*/bin/python[0-9.]*"|[^ "]*/bin/python[0-9.]*' "$_hermes_bin" 2>/dev/null | head -1 | tr -d '"')"
+  fi
+  # A console script generated by pip: its own shebang names the interpreter.
+  if [[ -z "$HERMES_PY" ]]; then
+    _shebang="$(head -1 "$_hermes_bin" 2>/dev/null)"
+    [[ "$_shebang" == '#!'*python* ]] && HERMES_PY="${_shebang#\#!}"
+  fi
+fi
 
 if ! command -v hermes >/dev/null 2>&1; then
   warn "hermes not on PATH — skipping. Register manually later:"
@@ -157,8 +192,27 @@ $(printf '\033[1;32mInstalled.\033[0m') Two things left, both yours:
 
 Then:
 
+EOF
+
+# Only name the dashboard and the journal when units actually got installed.
+# Pointing someone at `journalctl --user -u socialmag-refresh` for a unit that
+# was never created is the same class of lie as a silent fallback: it reads as
+# working and answers with nothing.
+if [[ -n "$USER_BUS" ]]; then
+  cat <<EOF
   dashboard   http://127.0.0.1:8321/dashboard.html
   check       $VENV/bin/socialmag-refresh
   logs        journalctl --user -u socialmag-refresh -f
 
 EOF
+else
+  cat <<EOF
+  check       $VENV/bin/socialmag-refresh
+  dashboard   start the file server yourself (see the warnings above), then
+              http://127.0.0.1:8321/dashboard.html
+
+  No units were installed, so nothing refreshes on a timer yet and there is no
+  journal to read. Fix the user bus above and re-run to get those.
+
+EOF
+fi