fix(lazy-deps): set CMAKE_POLICY_VERSION_MINIMUM=3.5 for native builds

[MwC-Trexx]

Problem

On macOS 26 with cmake 4.x, ensure("platform.matrix") fails at the cmake configure step before it even gets to compile:

CMake Error at CMakeLists.txt:1 (cmake_minimum_required):
  Compatibility with CMake < 3.5 has been removed from CMake.

cmake 4.x dropped support for cmake_minimum_required(VERSION < 3.5). python-olm 3.2.16 bundles libolm source with CMakeLists.txt declaring VERSION 3.4.

Fix

Set CMAKE_POLICY_VERSION_MINIMUM=3.5 in the build environment passed to uv/pip. cmake 4.x reads this env var and treats the project as though it declared the minimum as 3.5. One env key, no source patching, no platform gating.

Relationship to #31354

#31354 fixes the C++ const-pointer compile error in list.hh. This fixes the cmake configure error that fires before compilation starts. On macOS 26 / cmake 4.3.x, both are needed. Without this change, #31354's patched source build still aborts at the configure step.

Note: the subprocess in _python_olm_macos_install (added by #31354) doesn't pass an explicit env=, so it'll also need this fix when that PR merges — either inherit it from the calling process or pass env={**os.environ, "CMAKE_POLICY_VERSION_MINIMUM": "3.5"} directly.

Testing

# Fresh hermes venv, cmake 4.3.3, Apple clang 21.0.0 (macOS 26)
uv pip uninstall python-olm mautrix
CMAKE_POLICY_VERSION_MINIMUM=3.5 uv pip install "mautrix[encryption]==0.21.0"
# → installs cleanly; previously failed at cmake configure step

[teknium1]

Thanks for isolating the CMake policy issue. The current lazy-install path has moved since this branch.

Problems

• The change only adds the variable to uv_env (tools/lazy_deps.py:359 in this PR). On current main, if uv is absent or returns nonzero, the fallback at tools/lazy_deps.py:702 runs python -m pip install without env=, so it can still reach the same native build without CMAKE_POLICY_VERSION_MINIMUM.
• Current main replaced the base branch's os.environ copy with hermes_subprocess_env(inherit_credentials=False) at tools/lazy_deps.py:659-661 in 9c6229ce; salvage should preserve that credential-safe environment.

Suggested changes

• Add the policy variable to the current sanitized environment and pass it to both uv and pip install subprocesses.
• Add tests that assert both installer tiers receive the variable.

Automated hermes-sweeper review.

[teknium1]

Please carry this explicit environment into the python -m pip install fallback as well. Current main's fallback runs without env= at tools/lazy_deps.py:702, so an unavailable or failed uv binary would still invoke CMake without this policy setting.