fix(install): survive pip-less uv-created Hermes venvs; stop hiding errors

fix(install): survive pip-less uv-created Hermes venvs; stop hiding errors

Found installing on a fresh Debian 13 machine (Hermes installed via its
own uv-based install.sh):

- Root cause: 'uv venv' does not seed pip into the Hermes runtime venv,
  so '$PYTHON -m pip install' died with 'No module named pip' and the
  installer's suggested manual pip command would have failed the same
  way. Dependency installation now chains: pip -> ensurepip-bootstrapped
  pip -> 'uv pip install --python' (uv probed on PATH and at
  $HERMES_HOME/bin/uv, covering non-login SSH shells with minimal PATH).
- No more silent failures: every fallible step (deps, model preload,
  hermes config set, plugin validation) captured stderr behind
  2>/dev/null, making the remote failure undebuggable. All of them now
  capture combined output into DIAG_DIR (cleaned via EXIT trap) and
  print a show_log_tail excerpt on failure; failure guidance names
  commands that actually work on a pip-less host (uv, ensurepip).
- Docs: Documentation/index.org step 2 describes the install chain;
  AGENTS.org gains the uv-venv-has-no-pip and no-silent-2>/dev/null
  pitfalls and the tooling note describes the new chain.

Verified with a stubbed-environment ad-hoc harness (20/20): pip-less
uv venv + broken ensurepip + uv present (exact remote repro) installs
via uv; pip-present venv uses pip; total failure prints captured
diagnostics and working manual commands. Canonical suite green.