feat(pkg): FreeBSD hermes runtime baseline — ffmpeg, py311-pillow, python311

Tier 1 of the hermes out-of-the-box dependency sweep. hermes is a Python/uv app
(requires-python >=3.11,<3.14) whose venvs use --system-site-packages, so system
py311-* pkgs satisfy compiled deps without building.

- ffmpeg: hermes runtime baseline (installer) + voice-transcription/media skills.
- py311-pillow: Pillow is a hermes CORE dependency; the --system-site-packages
  venv picks up the prebuilt system pkg (no source build).
- python311 explicit (python3 = 3.11 after the default flip); python312 stays.
- Fix the stale "python312 owns python3" comment.

Covers hermes core + telegram gateway + voice. Tier 2 (discord-voice libsodium/
opus, astro vips, ollama/llama-cpp) pending confirmation of default integrations.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/pkg-list-host.txt

@@ -14,9 +14,9 @@ bsddialog
 codex
 
 # Python / tooling
-# python312 is our application Python. FreeBSD's pkg repos default to
+# python3 is 3.11 (FreeBSD's PYTHON_DEFAULT — see layered-soul TOOLCHAIN.md).
-# Python 3.11, so system deps (git, libinput, etc.) pull python311
+# python312 stays installed and available as python3.12 for apps needing newer.
-# autonomously. Both versions coexist; python312 owns the python3 symlink.
+python311
 python312
 just
 uv
@@ -36,6 +36,11 @@ postgresql18-client
 dnsmasq
 
 # Media / fonts
+# ffmpeg: hermes runtime (media + voice-transcription skill). py311-pillow:
+# hermes core Pillow dep — venvs use --system-site-packages, so the prebuilt
+# system pkg satisfies it without compiling Pillow.
+ffmpeg
+py311-pillow
 dejavu
 
 # Wayland display stack (desktop installs)