hermes - 💡(How to fix) Fix Feature request: label Docker sandbox containers for safe cleanup automation (Docker terminal backend)

Summary

Add a Docker label (e.g. io.hermes.sandbox=true) to sandbox containers spawned by the Docker terminal backend, so external cleanup automation (cron, systemd timer, etc.) can safely target only Hermes-managed containers.

Problem

The Docker terminal backend spawns one container per hermes_ask call (named hermes-<8hex>) and these containers persist as Exited (143) after the call completes — no --rm flag, presumably by design (useful for post-mortem docker logs debugging). Over days/weeks they accumulate.

The natural cleanup recommendation is: ```bash docker container prune -f --filter "until=24h" ```

But docker container prune only supports until and label filters — not name. So users can only scope cleanup safely if either:

1. The host is dedicated to Hermes (no other Docker containers exist) — my current workaround on a single-purpose VM
2. The Hermes containers are labeled

Without a label, users on shared hosts must fall back to scripting around docker ps + docker inspect timestamps + shell date math, which is fragile.

Proposal

At sandbox container spawn (Docker terminal backend), add a few labels:

```python labels={ "io.hermes.sandbox": "true", # optional, for finer tracking / debugging: # "io.hermes.sandbox.created_at": iso_timestamp, # "io.hermes.sandbox.session_id": session_id, } ```

Then users can safely automate cleanup with a one-liner that works on any host:

```bash docker container prune -f --filter "until=24h" --filter "label=io.hermes.sandbox=true" ```

Benefits

• Safe cleanup automation on shared hosts (no naming assumption needed)
• Tiny patch (~3 lines in the Docker backend spawn call)
• Doesn't break existing behavior
• Follows OCI label convention (io.<reverse-domain>.<key>)
• Enables observability tooling (Prometheus cAdvisor label-based metrics, docker stats --filter label=..., etc.)

Context

Encountered while setting up daily cleanup automation (systemd user timer) for my Hermes Agent + hermes-mcp bridge setup. Currently working around with a dedicated-host assumption, but a label would generalize cleanly to any user with mixed Docker workloads.

The Daytona backend has a different but related issue tracked in #28299 (naming conflicts) — this proposal specifically addresses the Docker backend's cleanup automation UX.