fix(update): ignore shared deps when refreshing lazy backends

[Gigisanta]

Summary

hermes update currently treats a lazy backend as active when any declared package is installed. Shared secondary dependencies such as aiohttp therefore mark platform.matrix active even when Matrix was never configured or installed. Every update then attempts to build mautrix[encryption] / python-olm, producing a recurring optional-backend warning on current macOS toolchains.

Use each feature's first declared spec as its primary activation anchor. Secondary/shared packages no longer trigger unrelated backend installs.

Reproduction

On a standard Hermes environment with aiohttp installed but no mautrix:

• before: platform.matrix in active_features() is True
• after: False

The existing multi-package partial-install behavior remains covered through the primary package (slack-bolt).

Verification

• python -m pytest tests/tools/test_lazy_deps.py -q
• 65 passed
• live refresh probe: 25 current, 0 failed; platform.matrix absent

[alt-glitch]

This was generated by AI during triage.

Related to #27878: both use the same primary-package activation fix. This PR also changes the trace-upload dependency pin, so it is not a mechanical duplicate; please consider splitting that independent delta.

[tonydwb]

Code Review Summary

Verdict: Approved

Fix ignores shared deps when refreshing lazy backends (+19 -9). Clean dependency management fix.

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused reproduction. The false-positive premise remains present on current main: tools/lazy_deps.py:870 activates a feature when any dependency is installed, and hermes_cli/main.py:7714-7726 passes that list into the update refresh.

Problems

• The replacement at tools/lazy_deps.py:870 drops the existing partial-install recovery contract documented in tests/tools/test_lazy_deps.py:319-327: a remaining non-primary package no longer causes hermes update to repair the feature.
• tools/lazy_deps.py:242 also changes the trace-upload huggingface-hub pin. This is independent of activation detection, matching the split request in the existing member comment.

Suggested changes

• Split the trace dependency change.
• Preserve both requirements with durable activation state rather than inferring activation from tuple order; add tests for aiohttp-only Matrix and a non-primary partial installation.

Automated hermes-sweeper review.

[teknium1]

This fixes shared-dependency false positives, but it also removes the existing partial-install recovery behavior documented by the prior test: if slack-bolt is missing while another Slack-specific dependency remains, update will no longer detect and repair Slack. Please use activation state (or preserve that case) rather than making tuple position the activation record.

[teknium1]

Please split this trace-upload dependency pin into a separate change. It is independent of lazy-feature activation, as the existing member comment also notes.