fix(cli): add timeout and progress output to npm install during update (supersedes #18866)

[shellybotmoyer]

Problem

hermes update appeared to hang indefinitely at "Updating Node.js dependencies..." because:

1. npm install ran with --silent flag, suppressing ALL output (including progress from postinstall scripts like npx Camofox-js fetch)
2. No timeout on subprocess.run() — if npm hangs, the update process hangs forever
3. No progress indication to the user that something is happening during long downloads

Fix

1. Added timeout=300 to _run_npm_install_deterministic() — prevents indefinite hangs. Both npm ci and npm install now have a 5-minute timeout per directory. TimeoutExpired exceptions are caught and converted to meaningful error messages instead of hanging.

2. Replaced --silent with --loglevel=warn — shows warnings and errors (useful for debugging) while still suppressing the noisy progress bars and audit messages. Users can now see if something goes wrong instead of staring at a blank screen.

3. Added progress message — prints "Installing {label}... (this may take a moment during postinstall scripts)" before each npm install so users know what's happening.

4. Updated both call sites — _update_node_dependencies() and _build_web_ui() both use the same function and both now pass timeout.

Fixes #18840

---

Rebased onto current main (resolves merge conflict with encoding="utf-8" addition in _run_npm_install_deterministic). Supersedes #18866 which was in DIRTY state.

[alt-glitch]

Supersedes #18866 (same fix, rebased). Also competes with #18869 (streaming approach). All fix #18840.

[shellybotmoyer]

Superseded by clean rebase → #25990. Closing this one.

[shellybotmoyer]

Superseded by #25990 (clean rebase resolving the merge conflict in hermes_cli/main.py).