runuser requires root. When the hermes user calls the shim directly (e.g. via su - hermes), exec the binary directly instead.
APP='Hermes Agent' produces NSAPP='hermesagent' via build.func's lowercase+strip-spaces logic. Rename ct/, install/, json/, and header files to match.