fix: invalidate stale update cache after manual pulls

[taewookyang]

Summary

• invalidate cached update-check results when the local git HEAD changes after a manual pull
• store the local HEAD revision alongside the cached behind-count
• add regression tests covering both cache reuse and stale-cache invalidation

Problem

hermes --version could keep showing a stale "commits behind" banner for up to 6 hours after a user manually updated a git checkout with git pull + pip install, because .update_check only keyed freshness on timestamp and embedded revision.

Test Plan

• ./venv/bin/python -m pytest tests/hermes_cli/test_update_check.py -q -o addopts=''
• manual repro/verification on Termux by seeding a stale .update_check file and confirming check_for_updates() rewrites it to behind=0 when local HEAD changed

[alt-glitch]

Duplicate of #18236 (and the broader #9670 chain). Multiple PRs already open addressing the same stale update-check cache invalidation when HEAD moves after manual git pull: #5359, #9670, #11210, #18236, #21447.

[taewookyang]

Local verification on my side passed:

• ./venv/bin/python -m pytest tests/hermes_cli/test_update_check.py -q -o addopts=''
• Result: 9 passed

Also, all PR workflows currently show action_required with 0 jobs (Tests / Nix / Lint / Contributor Attribution Check / Supply Chain Audit), so it looks like the fork PR workflows have not actually started yet.

If a maintainer can approve/run the workflows for this PR, I can re-check CI after that.

[taewookyang]

After reviewing the existing PRs, I realized this change overlaps with #18236 and #21447, which address the same stale update-check cache issue with a very similar approach.

In particular, #21447 appears to cover the broader case by tracking both the local checkout state and the upstream ref, so I don't want to add more fragmentation here.

I'm closing this PR to keep the discussion consolidated. For what it's worth, I did verify this fix path locally in a Termux (Android) environment with:

• ./venv/bin/python -m pytest tests/hermes_cli/test_update_check.py -q -o addopts=''
• Result: 9 passed

So at least from that environment, the reproduction and fix behavior checked out. If any of the existing PR authors want to reuse the test framing or Termux verification angle, please feel free.

Thanks!