fix(cli): invalidate update-check cache when installed version changes

[Bartok9]

Summary

• Add the installed VERSION to the update-check cache payload and require it to match on read.
• Fixes a stale "N commits behind" banner that persisted for up to 6 hours after a pip/uv upgrade.

Motivation

Closes #34491.

For pip/uv installs, HERMES_REVISION is unset, so embedded_rev is always None in check_for_updates(). The cache-validity check only compared the cached rev to embedded_rev (None == None), which never invalidated the cache. After upgrading (e.g. 0.14.0 → 0.15.1), the old cache's behind count stayed valid until the 6h TTL expired, so hermes --version kept reporting a stale "1 commit behind" even though the user was up to date.

The fix adds "version": VERSION to the cache payload and requires cached.get("version") == VERSION on read, so a version change forces a fresh check. The nix path (embedded_rev set) is unaffected — it now simply has an additional, always-satisfied guard.

Verification

• python3 -m pytest tests/hermes_cli/test_update_check.py — 10 passed
• New regression test test_check_for_updates_invalidates_on_version_change reproduces the bug: it fails on current main (returns the stale 1) and passes with this fix (returns a fresh 0).
• New test_check_for_updates_writes_version_to_cache asserts the version is persisted so future upgrades invalidate correctly.
• Updated test_check_for_updates_uses_cache to write the current VERSION (a same-version cache is still honored — no extra git calls).

Reproduce (from the issue)

1. Install 0.14.0, run hermes --version (writes cache with behind: 1)
2. uv pip install --upgrade hermes-agent to 0.15.1
3. Before: still shows "1 commit behind" for up to 6h. After: correctly shows "Up to date".

[Bartok9]

Closing as superseded by #34846 (689ef5e23, feat(cli): warn on unsupported pip installs + fix stale update-check cache (#34491)), merged May 29.

Both PRs fix the same issue #34491 the same way. Main's hermes_cli/banner.py now invalidates the .update_check cache when either the embedded rev or the installed VERSION changes (cached.get("ver") == VERSION guard at the cache-read), with a comment describing the exact pip-upgrade-changes-VERSION-but-not-rev case my PR targeted — plus the bonus unsupported-pip-install warning. No daylight left between the two. Thanks!