refactor(cli): extract web-UI build and PE-integrity helpers from hermes_cli/main.py (shard s3)

[andrexibiza]

Godfile kill — hermes_cli/main.py shard s3

Extracts the web-UI build and PE-integrity helper clusters from hermes_cli/main.py into two focused modules (5x2x3 blind-witness extraction, waves 1-3 verified):

• hermes_cli/web_ui_build.py (+514) — build staleness, content hashing, stamps
• hermes_cli/pe_integrity_mixin.py (+373) — Windows PE-integrity gate

Verbatim method bodies; module-level test constants stay; regression tests shipped.

Line math: 33 added / 798 deleted in hermes_cli/main.py (moved into the new modules). hermes_cli/main.py re-exports the moved names so all existing callers resolve identically.

Testing

• tests/hermes_cli/test_s3_w1b_extraction_regression.py (+212) shipped
• Seam identity verified: moved names resolve through main.py re-exports

Related #78791 #78792 #77376 #77746 #77748 #77751 #77752 #77756 #77759 #79066 #79067 #79068 #79069 #79070 #78689 #78690 #78691 #78692 #78693 #78694 #78695 #78696 #78697 #78698 #78699 #78700 #78701 #78702 #78703 #78704 #78705 #78706 #78707 #78708 #78709 #78710 #78711 #78712 #78713 #78714 #78715 #78716 #78717 #78718 #78719 #78720 #78721 #78722 #78723 #78724 #78725 #78726 #78727 #78728 #78729 #78730 #78731 #78732 #78733 #78734 #78735 #78736 #78737 #78738 #78739 #78740 #78741 #78742 #78743 #78744 #78745 #78746 #78747 #78748 #78749 #78750 #78751 #78752 #78753 #78754 #78755 #78756 #78757 #78758 #78759 #78760 #78761 #78762 #78763 #78764 #78765 #78766 #78767 #78768 #78769 #78770 #78771 #78772 #78773 #78774 #78775 #78776 #78777 #78778 #78779 #78780 #78781 #78782 #78783 #78784 #78785 #78786 #78787 #78788 #78789 #78790

[spfcraze]

This was generated by AI during triage.

Summary:
The title and body describe this PR as the kanban_db.py ready-promotion/triage extraction with its line math in run.py, but the diff moves web-UI build and PE-integrity helpers out of hermes_cli/main.py into two new modules.

Problems:

• The title names kanban_db.py and the ready-promotion + triage mixins; the diff contains no kanban reference — the new modules are web_ui_build.py (build staleness, content hashing, stamps) and pe_integrity_mixin.py (Windows PE-integrity gate).
• The body's line math cites run.py ("1134 added / 798 deleted in run.py"); the diff contains no run.py — the 798 deletions are in hermes_cli/main.py, which re-exports the moved names.

Solution:
As a title that matches the diff: "refactor(cli): extract web-UI build and PE-integrity helpers from hermes_cli/main.py (shard s3)"; the body's line math would read "1134 added / 798 deleted in hermes_cli/main.py".

---

Checked against a52c880 — the tip of gfg/main-extract-s3-w1b when this was written.

[andrexibiza]

Fixed — title, body, and head-commit message now match the diff. Corrected:

• Title → refactor(cli): extract web-UI build and PE-integrity helpers from hermes_cli/main.py (shard s3) (as suggested).
• Body → names hermes_cli/main.py (not run.py) and the two extracted modules (web_ui_build.py + pe_integrity_mixin.py), with the correct line math: 33 added / 798 deleted in main.py.
• Head commit → amended to the same corrected message (9fadd4985a); tree is byte-identical to the previously reviewed tip a52c88051 (verified: identical tree SHA), so nothing behavioral changed.

The kanban/ready-promotion/triage references were stale campaign-template metadata; no kanban code is in this diff, as the file list always showed. Validation: git diff --check clean; regression test tests/hermes_cli/test_s3_w1b_extraction_regression.py (shipped in this PR) covers the moved helpers.