fix(install): keep managed node private

[Bruce-anle]

Summary

• Stop POSIX installers from linking Hermes-managed node/npm/npx into user-global command directories.
• Add shared Python Node runtime helpers for version-floor checks, process-local PATH augmentation, private npm resolution, and legacy symlink cleanup.
• Clean old Hermes-owned node/npm/npx links during update, TUI bootstrap, dependency ensure, and uninstall.

Details

• Keeps the POSIX Node floor aligned with the desktop build requirement: ^20.19 || >=22.12.
• Preserves the node-bootstrap cascade through PATH Node, Hermes-managed Node, fnm, proto, nvm, Termux pkg, Homebrew, and bundled fallback.
• Does not shadow a modern user-managed Node only because npm is missing.
• Keeps update-time npm installs on the user Node path when PATH npm is selected with a modern PATH Node, avoiding Hermes-managed Node shadowing in that subprocess.
• Leaves gateway/systemd service PATH behavior out of scope for a separate PR.

Related

• Addresses the Hermes-managed Node symlink pollution class discussed around PR #38889 still creates node/npm/npx shims in ~/.local/bin for user macOS installs, shadowing Homebrew/nvm #45279, [Bug]: Setup SABOTAGES computer integrits - npm global installs hijacked to ~/.hermes/node breaks other software #18357, and Installer symlinks node/npm/npx into ~/.local/bin ahead of nvm, but uninstall leaves them behind #34536.
• Related open work includes fix(install): keep Hermes-managed Node private instead of hijacking the user's node #47897; this version keeps Python runtime behavior in one helper, adds update-time cleanup, and keeps managed Node private to Hermes subprocesses.

Test Plan

• /home/brucean/.hermes/hermes-agent/venv/bin/python -m pytest tests/hermes_cli/test_node_runtime.py tests/hermes_cli/test_dep_ensure.py tests/hermes_cli/test_tui_resume_flow.py tests/hermes_cli/test_cmd_update.py tests/hermes_cli/test_uninstall_node_symlinks.py tests/test_install_sh_node_global_prefix.py -q
  • 111 passed in 37.39s
• bash -n scripts/install.sh
• bash -n scripts/lib/node-bootstrap.sh
• git diff --check HEAD~3..HEAD

Notes

• Windows install.ps1 is intentionally out of scope for this POSIX-focused change.
• Gateway/systemd PATH generation is intentionally left for a separate follow-up.

[teknium1]

Closing — same as #47897. The managed-Node prefix hijack is already solved on main via #46085's prefix-local ~/.hermes/node/etc/npmrc (scoped to the managed Node, never the user's global npmrc), while the node/npm/npx symlinks are intentionally retained (#38889) for FHS root installs. Removing them regresses that path.

This PR's new hermes_cli/node_runtime module duplicates helpers that already live in hermes_constants.py on main — find_node_executable, iter_hermes_node_dirs, with_hermes_node_path, hermes_managed_node_tree_present, heal_hermes_managed_node — plus remove_node_symlinks() in hermes_cli/uninstall.py. Nothing left to add. Thanks for the effort and the version-floor idea.