Summary

Closes #1102. Makes "skip now, install later" genuinely lossless for both
optional apps (Wave 3 / WS-H, decision Q9):

• hal0 app install openwebui — new CLI verb + HAL0_SKIP_OPENWEBUI=1
  install-time escape hatch (mirrors the existing HAL0_SKIP_HERMES
  pattern). Both the install-time path (apply_setup → install_extension)
  and the deferred CLI verb now call the SAME install_openwebui() function
  in src/hal0/install/extensions.py, which reproduces installer/install.sh's
  podman-runtime guard (enable+wait_active when podman is usable; quiesce
  the unit with disable/reset-failed otherwise) so now-vs-later behave
  identically.
• Hermes gateway fold-in — hal0 agent install hermes now installs +
  enables the Telegram/Discord gateway by default (new
  --gateway/--no-gateway flag, default on). This ports
  installer/install.sh's inline post-provision gateway block (hermes gateway install --system --run-as-user hal0 → systemctl enable --now hermes-gateway) into src/hal0/cli/agent_commands.py, which previously
  only ran when install.sh itself provisioned Hermes in the same run — a
  box that deferred Hermes via HAL0_SKIP_HERMES=1 and installed it later
  never got the gateway wired.

Both failure paths are best-effort (warn + continue), matching install.sh's
posture: a broken gateway or a missing container runtime must not be
reported as a failed install.

Scope note

Per the isolation guardrails for this workstream, answers.py /
setup_command.py / orchestrate.py were left untouched — the
apps.*.when / apps.hermes.gateway answer-file keys (mentioned in the
issue's "Answer-file coverage" addendum) still warn-and-ignore pending
whoever owns that loader; wiring them cleanly would need a Selections
field this issue didn't add, to avoid conflicting with the parallel
answer-file PRs in flight.

Changes

• src/hal0/install/extensions.py — install_openwebui() (shared wiring,
  runtime-guard ported from install.sh), install_extension("openwebui")
  delegates to it.
• src/hal0/cli/app_commands.py (new) — hal0 app install <name> Typer
  sub-app.
• src/hal0/cli/main.py — mounts the new app sub-app.
• src/hal0/cli/agent_commands.py — --gateway/--no-gateway flag on
  agent install; _install_hermes_gateway() / _wait_active_unit()
  ported from install.sh.
• installer/install.sh — HAL0_SKIP_OPENWEBUI=1 escape hatch around the
  existing OpenWebUI enable block.
• docs/reference/cli.mdx — documents hal0 app install and the new
  hermes gateway flag.
• Tests: tests/install/test_extensions.py, tests/cli/test_app_install_openwebui.py,
  tests/cli/test_agent_install_hermes.py (gateway section; two
  pre-existing tests updated to pass gateway=False so they keep testing
  only the toolchain→bootstrap→register sequence).

Test plan

• uv run ruff format --check src tests
• uv run ruff check src tests
• uv run pytest tests/install/test_extensions.py tests/cli/ -q — 3
  pre-existing failures only (test_install_hermes_runs_prereqs_then_bootstrap_then_register,
  test_agent_shim.py::TestHermesEnv x2), confirmed via git stash to
  fail identically on main — caused by a live
  /var/lib/hal0/venvs/hermes on this box + running as root, unrelated
  to this change.
• uv run pytest tests/ -q --ignore=tests/e2e — 4630 passed, 14 failed,
  1 error, 8 skipped — matches the documented ~14 known pre-existing
  failures on this box (hardware/pve, comfyui_phase4, config_urls,
  models_preview, settings_models_store, hermes wrapper/state-render,
  container_spec_dispatch, openwebui prewire — none touch files this PR
  changes).
• Manual: fresh install with HAL0_SKIP_OPENWEBUI=1 HAL0_SKIP_HERMES=1,
  then hal0 app install openwebui + hal0 agent install hermes on a
  real box (not run here — no live installer target in this sandbox).

🤖 Generated with Claude Code