refactor: remove redundant .gitconfig tmpfiles rule, use GIT_INIT_DEFAULT_BRANCH env var

The .gitconfig at /home/hermes/.gitconfig was never read because the
hermes-agent service sets HOME=/var/lib/hermes. Git identity was already
fully covered by GIT_AUTHOR_* and GIT_COMMITTER_* env vars via .env.

Replace the dead .gitconfig's init.defaultBranch with the env var
GIT_INIT_DEFAULT_BRANCH (supported since Git 2.28).

hosts/m3-hermes/services/hermes-agent.nix

@@ -49,13 +49,6 @@ in {
           user: m3ta-chiron
           default: true
     ''}"
-    "f /home/hermes/.gitconfig 0644 hermes hermes - ${pkgs.writeText "gitconfig" ''
-      [user]
-        name = m3ta-chiron
-        email = m3ta-chiron@agentmail.to
-      [init]
-        defaultBranch = master
-    ''}"
   ];
 
   systemd.services.copy-hermes-skills = {
@@ -95,12 +88,17 @@ in {
     ];
 
     # Non-secret environment variables
+    # Git identity is set entirely via env vars (GIT_AUTHOR_*, GIT_COMMITTER_*,
+    # GIT_INIT_DEFAULT_BRANCH) — no .gitconfig file needed. Env vars take
+    # precedence over any gitconfig, and the hermes gateway injects them into
+    # all terminal sessions via .env.
     environment = {
       GLM_BASE_URL = "https://api.z.ai/api/coding/paas/v4/";
       GIT_AUTHOR_NAME = "m3ta-chiron";
       GIT_AUTHOR_EMAIL = "m3ta-chiron@agentmail.to";
       GIT_COMMITTER_NAME = "m3ta-chiron";
       GIT_COMMITTER_EMAIL = "m3ta-chiron@agentmail.to";
+      GIT_INIT_DEFAULT_BRANCH = "master";
 
       # ── API Server (OpenAI-compatible, for Hermes Desktop App) ─────────
       # Accessible via Netbird mesh VPN — not exposed to the public internet.