fix(update): preserve activated extras across runtime rebuilds

[hxwvaa]

Root cause

hermes update rebuilt the managed environment with .[all], then called active_features() to decide what to refresh. That detector infers activation from packages currently installed in the environment. A replacement runtime has already removed a lazy backend's anchor package, so the updater cannot recover the previously active feature.

Reproduction

1. Activate Telegram (python-telegram-bot[webhooks]==22.6).
2. Set security.allow_lazy_installs: false.
3. Run an update that replaces the managed runtime.
4. The core .[all] install omits Telegram, and post-rebuild active_features() returns no Telegram feature.

Why active-feature detection fails after removal

It is intentionally presence-based and does not persist history. Once the replacement runtime has dropped the package, its anchor is gone; probing after the rebuild cannot distinguish “previously activated then removed” from “never activated.”

Fix design

Snapshot the allowlisted active lazy features before the update can replace site-packages, then restore that exact snapshot after the core dependency install. The restore path only accepts names in LAZY_DEPS and its pinned specs, so it is general across declared lazy backends without accepting arbitrary packages. Cold features remain absent.

Security behavior

This does not modify security.allow_lazy_installs. Runtime ensure() remains blocked when it is false. The explicit updater may restore only dependencies already captured before its own managed-runtime rebuild.

Tests executed

• Added regression test: failed before the fix with AttributeError: module 'tools.lazy_deps' has no attribute 'restore_features'.
• python -m pytest tests/tools/test_lazy_deps.py tests/hermes_cli/test_lazy_refresh_venv_repair.py -q: 84 passed.
• ruff check tools/lazy_deps.py hermes_cli/main.py tests/tools/test_lazy_deps.py tests/hermes_cli/test_lazy_refresh_venv_repair.py: passed.
• py_compile tools/lazy_deps.py hermes_cli/main.py: passed.
• Canonical scripts/run_tests.sh could not run on the Windows author host because it invokes WSL and no WSL distribution is installed. Direct broader collection is also blocked by Linux-only test prerequisites; CI is required for platform-parity validation.
• ty check tools/lazy_deps.py hermes_cli/main.py reports existing diagnostics across hermes_cli/main.py outside this diff.

Fixes #72924