fix(update): approve npm install scripts used by update

[LeonSGP43]

Summary

• add pinned allowScripts entries for the packages Hermes update currently installs
• cover both the repo-root --workspaces=false install and the ui-tui/web workspace install path
• keep the policy limited to the exact versions currently exercised on main

Testing

• npm install --dry-run --no-fund --no-audit --progress=false --workspaces=false
• npm install --dry-run --no-fund --no-audit --progress=false --workspace ui-tui --workspace web
• git diff --check

Closes #43997

[teknium1]

Thanks for the focused update-path policy change. Current main still runs the same scoped npm installs—root at hermes_cli/main.py:8245-8258, then ui-tui and web at hermes_cli/main.py:8266-8275—and the root manifest still has no allowScripts key (package.json:35-45). The four pinned entries match current lockfile install-script packages.

The change remains narrowly aligned with the update path because desktop is explicitly skipped by that flow (hermes_cli/main.py:8233-8239). Related PR #51471 overlaps these four entries and extends the policy to desktop packages; that is a maintainer policy-selection question, not a defect in this scoped patch.

Automated hermes-sweeper review.