feat: add modular JARVIS voice starter module

[agent-montes]

Summary

Adds JARVIS as an optional public-safe module inside hermes-starter, without replacing the starter template or importing old repo history.

This PR:

• Adds apps/jarvis-voice/ as an optional JARVIS voice app source snapshot.
• Adds modules/jarvis-voice/ with module metadata and a private Operations template.
• Extends scripts/init-workspace.sh with --list-modules and --with jarvis-voice.
• Adds docs/jarvis-voice.md.
• Adds docs/modular-installer.md.
• Adds NOTICE.md for provenance and public-safety notes.
• Strengthens .gitignore and hygiene checks for optional app outputs.

Why

The long-term goal is for hermes-starter to become a modular installer/template that anyone can safely clone and use to reproduce a Hermes setup.

JARVIS should be included as an optional feature module, not as the root repo and not as a force-pushed replacement for the starter.

Safety / No Secrets

This PR intentionally excludes .env, auth files, API keys, OAuth tokens, phone/channel IDs, sessions, gateway state, logs, transcripts, recordings, node_modules, local virtualenvs, dist, release, generated runtime files, and private machine paths.

Only placeholder/example config is included.

Verification

Completed locally:

• ./scripts/hygiene-check.sh
• ./scripts/init-workspace.sh --dry-run
• ./scripts/init-workspace.sh --dry-run --with jarvis-voice
• temp write-mode initializer smoke test
• ./scripts/sync-context-files.sh . --check
• python3 scripts/validate-yaml.py .
• bash -n scripts/*.sh
• Markdown lint across repo: 0 errors
• JARVIS app npm ci --ignore-scripts
• JARVIS app npm run build
• JARVIS app npm run package:mac
• Electron syntax checks
• Python helper compile checks
• staged public-safety scan: 0 findings
• clean staged-checkout smoke test

Notes

The JARVIS app is currently a preview module.

apps/jarvis-voice/build/icon.png is intentionally tracked as a packaging source asset.

Generated package output remains ignored in dist/ and release/.

Local machine did not have shellcheck or gitleaks; CI should run those checks.