feat(cli): add --branch flag to hermes update

[jquesnelle]

hermes update has always hard-coded its target to main. Add --branch so callers can update against a non-default channel while preserving every existing behavior at the default:

• hermes update still pulls main (no behavior change)
• hermes update --branch X pulls origin/X, auto-stashing and switching
  local HEAD to X first if needed
• hermes update --check --branch X reports behindness against
  origin/X (and skips the upstream/X probe,
  since forks don't have upstream copies of
  their own feature branches)
• Branch absent locally → retry as checkout -B X origin/X (track)
• Branch absent everywhere → exit 1 with a clear error, after restoring
  the user's prior stash so we don't strand
  them in a weird state

The fork-upstream sync logic was already guarded on branch == 'main', so non-main updates correctly skip the upstream trampling without further changes.

5 new tests cover: explicit --branch, default-to-main, switch-from-other, track-from-origin, and the fail-cleanly case. Full test_cmd_update.py suite (15 tests) passes on main.