fix(update): honor protected local workflows

[stefanpieter]

Summary

Adds an opt-in protected local update workflow guard for source checkouts that intentionally carry local commits or tracked customizations on top of upstream Hermes, such as customized dashboard installs.

When configured via environment variables, Hermes now:

• exposes the protected update controller from recommended_update_command() instead of telling users to run raw hermes update;
• blocks raw hermes update before the stock update/autostash path runs;
• prints the repo, protected branch, current branch, safer controller command, optional manual helper, and bypass instructions;
• fails closed with warnings if a configured protected branch/helper cannot be verified;
• preserves existing managed-install behavior and the default unconfigured hermes update path.

This addresses the dashboard/customization persistence class of failures discussed in #3523 and the update-command UX concern in #6357.

Configuration

Opt-in environment variables:

• HERMES_PROTECTED_UPDATE_COMMAND: command to show/run for the protected update workflow.
• HERMES_PROTECTED_UPDATE_BRANCH: optional local branch name to verify and display.
• HERMES_PROTECTED_UPDATE_HELPER: optional helper script path; if no command is configured, Hermes builds a python3 <helper> --repo <repo> --branch <branch> command.
• HERMES_PROTECTED_UPDATE_REBASE_COMMAND: optional manual rebase/helper command shown in the block message.
• HERMES_ALLOW_PROTECTED_BRANCH_UPDATE=1: explicit escape hatch to bypass the guard.

Validation

• git diff --check --cached
• python -m py_compile hermes_cli/config.py hermes_cli/main.py tests/hermes_cli/test_managed_installs.py
• python -m pytest tests/hermes_cli/test_managed_installs.py -q -o 'addopts=' → 13 passed
• Static scan of added lines for hardcoded secrets, shell injection, eval/exec, unsafe deserialization, and SQL-injection patterns → no findings
• Independent staged-diff review → passed after fixing the initial helper-path shlex import/test gap and branch-verification fail-open risk