M0: toolchain, monorepo scaffold, gateway plugin skeleton, CMP app

- gateway-plugin/: android platform plugin (plugin.yaml + adapter.py
  register(ctx) + no-op AndroidAdapter) + stub modules for M1-M5
- app/: Compose Multiplatform project (shared KMP + androidApp +
  desktopApp) with Gradle wrapper; builds :androidApp:assembleDebug
  and :desktopApp:compileKotlin
- scripts/guard_hermes_agent.sh + pre-commit hook: fail if hermes-agent/
  is staged (read-only reference, never committed)
- .gitignore excludes hermes-agent/; docs/ reference library

gateway-plugin/plugin.yaml

@@ -0,0 +1,67 @@
+name: android-platform
+label: Android
+kind: platform
+version: 0.1.0
+description: >
+  Native Android / Desktop client gateway adapter for Hermes Agent.
+  Runs a WebSocket server inside the gateway; the app connects with a
+  pairing token. Supports streaming, reasoning, structured tool events,
+  channels/threads, media, FTS5 search, and FCM/ntfy push.
+author: Iris x Hermes
+# ``requires_env`` / ``optional_env`` entries are surfaced in the
+# ``hermes config`` / ``hermes gateway setup`` UI via the platform-plugin
+# env var injector in ``hermes_cli/config.py``.
+requires_env:
+  - name: ANDROID_TOKEN
+    description: "Shared pairing token the app presents on connect"
+    prompt: "Android pairing token"
+    password: true
+optional_env:
+  - name: ANDROID_WS_HOST
+    description: "WS bind host (default 127.0.0.1; use 0.0.0.0 for LAN)"
+    prompt: "WS host"
+    password: false
+  - name: ANDROID_WS_PORT
+    description: "WS port (default 8790)"
+    prompt: "WS port"
+    password: false
+  - name: ANDROID_HOME_CHANNEL
+    description: "Default chat id for cron/notification delivery (default android:default)"
+    prompt: "Home channel"
+    password: false
+  - name: ANDROID_ALLOWED_USERS
+    description: "Comma-separated allowed device_ids (empty = token-only auth)"
+    prompt: "Allowed device ids"
+    password: false
+  - name: ANDROID_ALLOW_ALL_USERS
+    description: "Allow any paired device (dev only)"
+    prompt: "Allow all devices? (true/false)"
+    password: false
+  - name: ANDROID_PUSH_BACKEND
+    description: "Push backend: fcm (default) or ntfy"
+    prompt: "Push backend"
+    password: false
+  - name: ANDROID_FCM_SERVICE_ACCOUNT
+    description: "Path to Firebase service-account JSON (FCM HTTP v1)"
+    prompt: "FCM service account path"
+    password: true
+  - name: ANDROID_FCM_SERVER_KEY
+    description: "Legacy FCM server key (fallback if no service account)"
+    prompt: "FCM server key"
+    password: true
+  - name: NTFY_TOPIC
+    description: "ntfy topic for push (when ANDROID_PUSH_BACKEND=ntfy)"
+    prompt: "ntfy topic"
+    password: false
+  - name: NTFY_SERVER_URL
+    description: "ntfy server URL (default https://ntfy.sh)"
+    prompt: "ntfy server URL"
+    password: false
+  - name: ANDROID_WS_CERT
+    description: "TLS cert path for WSS (optional)"
+    prompt: "WSS cert"
+    password: false
+  - name: ANDROID_WS_KEY
+    description: "TLS key path for WSS (optional)"
+    prompt: "WSS key"
+    password: false