fix(update): re-provision outdated managed Node on engine failure

[teknium1]

Summary

The EBADENGINE recovery now re-provisions a healthy-but-outdated managed Node tree, closing the loop the Node-26 floor bump opened: every install sitting on a managed Node 22 tree (all historical installs, plus everything #76464 healed onto 22 before the bump) was stuck in an unfixable retry loop that dead-ends the GUI installer/updater and hermes update.

Root cause: three deliberate behaviors composed into a trap after 713a983 raised engines.node to >=26:

• heal_hermes_managed_node() only fires on broken trees — a runnable Node 22 tree is healthy, so heal never triggers.
• bootstrap_hermes_managed_node() reused any healthy tree, so the recovery handed back the same Node 22 npm and the retry failed identically.
• On the managed-npm path, a node-constraint failure was declared unfixable outright (correct before, wrong now that provisioning exists).

Changes

• hermes_constants.py: _probe_node_major() + managed_node_meets_target(); bootstrap_hermes_managed_node(force=...) reuses a healthy tree only when its Node major ≥ _HERMES_NODE_TARGET_MAJOR, otherwise re-provisions in place at the current target.
• hermes_cli/npm_engine.py: when the failing npm IS the managed one and the managed Node is below target, force a re-provision (followed by the usual npm-range upgrade) instead of looping on an npm-only upgrade or giving up.
• tests/hermes_cli/test_npm_engine.py: new coverage for the outdated-tree re-provision (asserts force=True so the healthy-tree shortcut can't sneak back) and the still-correct "current Node, node-only mismatch → decline" path.

Validation

	Before	After
Managed Node 22, repo demands ≥26	EBADENGINE loop forever (GUI + CLI dead-end)	tree re-provisioned to v26.5.1 + npm 12.0.2, retry succeeds
Managed Node current, node-only mismatch	declared unfixable	unchanged (correctly declines)
Current-major healthy tree	reused	reused (0.06s, no re-download)

E2E with real downloads in a temp HERMES_HOME: provisioned a v22.23.2 tree, replayed the GUI updater's node>=26 EBADENGINE against its npm → re-provisioned to v26.5.1 + npm 12.0.2 in 3.2s. Targeted tests: 92/92 across test_npm_engine.py, test_hermes_constants.py, test_cmd_update.py; ruff clean.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on bc1d911}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

3 visual diffs.

_{inline evidence upload failed.}

Failed to upload diff-1508682a2ae8-boot-ready-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-1508682a2ae8-boot-ready-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)

[teknium1]

Closing: #76562 returned the managed-Node target to 22, so no healthy managed tree is below target anymore and this re-provision path is dormant. If a Node-floor bump is re-attempted later, this can be revived — the outdated-tree gap it covers (heal only fires on broken trees) will exist again then.