feat: hermes auto-update cron with staggered offsets (+10min per node)

local.yml

@@ -89,6 +89,31 @@
         - ansible_os_family == "Debian"
       tags: [artemis]
 
+    # --- Hermes auto-update cron (fleet-wide, staggered offsets) ---
+    - name: Ensure hermes-update cron is installed
+      cron:
+        name: "hermes auto-update"
+        minute: "{{ hermes_update_offset | default(0) }}"
+        hour: "*/8"
+        user: root
+        job: "bash -c 'echo === $(date -Iseconds) hermes update === >> /var/log/hermes-update.log 2>&1 && hermes update --y >> /var/log/hermes-update.log 2>&1'"
+      when:
+        - ansible_os_family == "Debian"
+        - hermes_update_offset is defined
+      tags: [hermes_update]
+
+    - name: Ensure hermes-update log file exists
+      file:
+        path: /var/log/hermes-update.log
+        state: touch
+        owner: root
+        group: root
+        mode: '0666'
+      when:
+        - ansible_os_family == "Debian"
+        - hermes_update_offset is defined
+      tags: [hermes_update]
+
     - name: Print completion message
       debug:
         msg: "Baseline complete on {{ ansible_hostname }} — node_type={{ node_type | default('unspecified') }}, gpu={{ has_gpu | default(false) }}"