tooling: histcapture.py (auto HIST-QNA capture) + systemd timer

Captures user/assistant messages from /root/.hermes/state.db into the
'hermes' cube namespace as TYPE: HIST-QNA entries. Forward-only by default
(no backfill); --seed-hours N for bounded one-time population; idempotent;
--prune-older-than-hours to undo over-backfill. systemd timer runs every
5 min. Tested: 24h seed = 1171 msgs; prune cleared a 3164-entry backfill
to 44, then re-seeded correctly.

tools/histcapture.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=CUBELinux-2 historical-record capture (Hermes transcript -> cube 'hermes' ns)
+After=network.target
+
+[Service]
+Type=oneshot
+# Runs as root: root can read /root/.hermes/state.db and reach the luulu
+# cubed socket via the cubelinux group (gid 1002). Forward-only by default
+# (no backfill); state file tracks last pushed message id.
+ExecStart=/usr/bin/python3 /home/CUBELinux/CUBELinux-2/tools/histcapture.py
+Nice=10