The Dockerfile fix in #93757 only helps newly built images, and an
image upgrade (container recreate) resets the permission because
/opt/hermes lives in the image layer. The one stranded case is an old
image whose container was stopped and restarted after the lockout: it
keeps the 0700 install dir and runs code without the guard.
Document the one-line in-place recovery (chmod 0755 /opt/hermes as
root) in the Docker troubleshooting section.
Follow-up to #93757.
Ben Barclay
e26e25d618