fix(update): honor --ignore-cr-at-eol on git < 2.48 via --numstat

[Zeraphim]

What does this PR do?

Fixes _normalize_managed_eol (hermes_cli/update_cmd.py) so it actually
clears CRLF churn on managed checkouts when running on git < 2.48.

git diff --name-only --ignore-cr-at-eol silently ignores
--ignore-cr-at-eol on git < 2.48 (the flag is only honored on the
--numstat/--patch/--quiet output paths). As a result the
"real dirty" set equaled the full dirty set, _eol_only() was always
empty, and the core.autocrlf=false pin was written over a still-dirty
tree — the 5 regression tests from #74487 failed deterministically
(reproduced on git 2.43.0 / 2.45.2; CI passed only because it ran git 2.54).

This swaps the ignore-eol probe to --numstat, which honors the option on
every supported git version, and parses its path records. The non-ignore
path is unchanged.

Related Issue

Fixes #75175

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/update_cmd.py: in _normalize_managed_eol._dirty, use
  --numstat instead of --name-only when --ignore-cr-at-eol is
  requested, and parse the path fields from each numstat record.

How to Test

scripts/run_tests.sh tests/hermes_cli/test_update_eol_churn.py -q

Expected: 9 passed. On git < 2.48 (e.g. git 2.43/2.45) this was
5 failed / 4 passed before the fix.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(update): …)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've run scripts/run_tests.sh tests/hermes_cli/test_update_eol_churn.py -q and all tests pass
• I've added tests for my changes — existing regression tests (fix(update): repair managed checkouts still running core.autocrlf=true #74487) pin the contract; this change makes them pass on git < 2.48
• I've tested on my platform: macOS 26.2, git 2.45.2

Documentation & Housekeeping

• I've updated relevant documentation — or N/A (no user-facing behavior change)
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact — or N/A (version-robust by construction; any platform/git)
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Not needed — deterministic pytest fix.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #75213: both open PRs repair the same --name-only --ignore-cr-at-eol EOL-detection failure by using --numstat. Please consolidate the alternative implementations.

[teknium1]

Thanks for identifying the --name-only --ignore-cr-at-eol failure; the premise is confirmed on current main at hermes_cli/update_cmd.py:3075-3090.

Problems

• hermes_cli/update_cmd.py:3101 uses record.split("\t"). With -z, Git outputs literal pathname characters verbatim, including tabs, so this can split one pathname into fragments. The resulting incomplete real_dirty set feeds _eol_only() and can classify a real edit as checkout-safe, contrary to the preservation contract in tests/hermes_cli/test_update_eol_churn.py:118-127.
• The comment at hermes_cli/update_cmd.py:3098-3100 describes renamed records as tab-delimited. Git's documented --numstat -z rename/copy form instead has an empty path field followed by NUL-delimited preimage and postimage paths; the loop ignores those records.

Suggested changes

• Parse ordinary entries with only the first two tab splits, and parse the empty-path rename/copy form by consuming its following NUL path pair. Add tab-path and rename/copy preservation tests.

This is an automated hermes-sweeper review.

[teknium1]

With -z, literal tabs in a pathname are verbatim, so splitting on every tab turns one path into fragments. Rename/copy output is also NUL-delimited after the counts, not a fourth tab field. Parse only the first two tabs for ordinary entries and consume the following NUL path pair for rename/copy entries; otherwise a real edit can enter eol_only and be checked out.