fix: restore immutable update visibility

[Dannyxlm]

Summary

• restore the backend (+N) update count for CloudSeed's immutable managed runtime
• surface source-monitor freshness, blockers, candidate state, and release lineage in Hermes Desktop
• keep immutable updates request-only: the dashboard never runs hermes update against production
• harden the status contract against stale fetch receipts and make candidate requests atomic/idempotent

Root cause

CloudSeed intentionally disabled the stock in-place updater when it moved to immutable releases. The replacement source monitor was already live through Dannyxlm/cloudseed-infra#61, but the running Hermes backend did not expose that receipt to Desktop. Desktop therefore received the old suppression payload and rendered no count.

Cross-repo compatibility

• aligned with hermes-update-status.v1 produced by merged CloudSeed PR fix: resolve symlink bypass in write deny list on macOS NousResearch/hermes-agent#61
• reconciled onto current NousResearch/hermes-agent main
• preserved the fork-only Codex ephemeral plugin-context behavior through fork sync PR chore: sync fork with current Hermes upstream #2
• candidate-build actions remain deployment-gated and request-only; no service restart or production mutation occurs from the UI

Security/correctness follow-up

Independent review found and this PR closes two P1s:

1. freshness now uses the older of generated_at and last_fetched_at, so a freshly rewritten receipt cannot authorize stale upstream state;
2. candidate markers use atomic no-clobber publication, exact repeats are idempotent, and conflicting pending requests fail closed.

Verification

• tests/hermes_cli/test_dashboard_admin_endpoints.py + Codex app-server tests: 140 passed
• tests/hermes_cli/test_web_server.py: 523 passed
• Desktop managed-update UI/store tests: 31 passed
• Desktop TypeScript typecheck: passed
• Desktop production build: passed
• Ruff over all touched Python paths: passed
• git diff --check: passed
• scoped secret scan: zero findings

Automated by Ava on Danny's behalf.