refactor(main): extract shard s4 union (update_recovery + win_quarantine) from main.py

[andrexibiza]

Godfile kill — hermes_cli/main.py shard s4

Extracts the update-recovery breadcrumb helpers (cluster c3) and the Windows hermes.exe quarantine helpers (cluster c7) from hermes_cli/main.py into hermes_cli/update_recovery.py and hermes_cli/win_quarantine.py (5x2x3 blind-witness extraction, waves 1-3 verified). Verbatim method bodies routed through a lazy _m() reference for symbols that stay in main.py; main.py re-imports every moved name (# noqa: F401) so callers and test monkeypatches on hermes_cli.main resolve unchanged. Regression tests shipped for both modules.

Line math: 896 added / 520 deleted in main.py (moved into the two new modules).

Related #78791 #78792 #77376 #77746 #77748 #77751 #77752 #77756 #77759 #79066 #79067 #79068 #79069 #79070 #78689 #78690 #78691 #78692 #78693 #78694 #78695 #78696 #78697 #78698 #78699 #78700 #78701 #78702 #78703 #78704 #78705 #78706 #78707 #78708 #78709 #78710 #78711 #78712 #78713 #78714 #78715 #78716 #78717 #78718 #78719 #78720 #78721 #78722 #78723 #78724 #78725 #78726 #78727 #78728 #78729 #78730 #78731 #78732 #78733 #78734 #78735 #78736 #78737 #78738 #78739 #78740 #78741 #78742 #78743 #78744 #78745 #78746 #78747 #78748 #78749 #78750 #78751 #78752 #78753 #78754 #78755 #78756 #78757 #78758 #78759 #78760 #78761 #78762 #78763 #78764 #78765 #78766 #78767 #78768 #78769 #78770 #78771 #78772 #78773 #78774 #78775 #78776 #78777 #78778 #78779 #78780 #78781 #78782 #78783 #78784 #78785 #78786 #78787 #78788 #78789 #78790

Part of #78631
Part of #78647

[spfcraze]

This was generated by AI during triage.

Summary:
The title and commit message say this PR extracts workspace/worker mixins from kanban_db.py (shard s4), but the diff contains no change to hermes_cli/kanban_db.py — the actual content is the hermes_cli/main.py shard s4 extraction (update_recovery + win_quarantine) plus two contributor-email files.

Problems:

• The PR diff adds hermes_cli/update_recovery.py and hermes_cli/win_quarantine.py and edits hermes_cli/main.py, tests/hermes_cli/test_update_recovery_module.py, and tests/hermes_cli/test_win_quarantine_module.py; "kanban_db" appears nowhere in it, and hermes_cli/kanban_db.py (which exists at origin/main with its own test suite) is untouched.
• The commit b4656e5 — whose message the title matches — carries exactly this main.py shard s4 content, not a kanban_db.py extraction.
• The body's "Line math: 896 added / 520 deleted in run.py" names run.py, which is not among the files this PR changes.

Solution:
As a title matching the diff: "refactor(main): extract shard s4 union (update_recovery + win_quarantine) from main.py" — which is what this PR actually contains.

---

Checked against b4656e5 — the tip of gfg/main-extract-s4-w1a when this was written — and 9ea0197, main at the same moment.

[andrexibiza]

Good catch — the title and body misdescribed the diff. Corrected:

• Title → refactor(main): extract shard s4 union (update_recovery + win_quarantine) from main.py (matches commit b4656e5 and the actual changed files).
• Body → now names hermes_cli/main.py (not run.py) and the two extracted modules (update_recovery.py + win_quarantine.py), with the correct line math: 896 added / 520 deleted in main.py.

No code change needed — the extraction itself was already the main.py s4 shard; the metadata was stale from the campaign template. Validation on this branch: tests/hermes_cli/test_update_recovery_module.py and tests/hermes_cli/test_win_quarantine_module.py both pass (via scripts/run_tests.sh), git diff --check clean.