fix(updates): report backend update failures truthfully

[alexgunsberg]

Summary

Backend update checks now distinguish “already current” from “could not determine update state.” This preserves the independent Backend status needed by Desktop PR #82608.

What changed

• return structured backend update facts instead of collapsing Git failures into zero-behind
• classify repository ownership and writable-install failures without exposing raw command output
• surface truthful update capability and error codes through the Dashboard API
• retain remote-target-aware update facts

Scope

Backend only: hermes_cli/banner.py, hermes_cli/web_server.py, and three focused Python test files. Desktop UI changes remain isolated in PR #82608.

Verification at exact head 9d0e565

• 256 related banner, updater, and Dashboard admin endpoint tests passed
• the ownership regression fails against untouched base 244d296646909aca1dd16c9759491da0ef4cd163 (missing structured checker), proving it detects the old behavior
• Ruff passed on all five touched files
• git diff --check passed
• Real classifier probe: clean candidate returned behind=0, repo_writable=true; root-owned /opt/hermes-agent returned the intentional update-available-without-count sentinel with repo_writable=false, which the API maps to update_available=true, can_apply=false

[Riccardo-Vecchi]

The new structured status is a good direction, but the fallback currently erases the ownership/permission failure it is meant to surface.

[Riccardo-Vecchi]

[P1] Preserve fetch ownership/permission failures after the read-only compare

When fetch fails, this return converts any successful ls-remote comparison into (checked, None, head_rev), discarding fetch_error. A deterministic ownership case is: the ownership-relaxed HEAD probe succeeds; fetch without safe.directory fails with dubious ownership; the public ls-remote succeeds; this branch returns an available/current result with no error. If the install is writable despite the owner mismatch (for example root or group-writable), repo_install_writable() is also true, so /api/hermes/update/check still reports can_apply=true even though the update command cannot pass Git's ownership guard. Preserve the fetch error/capability failure while still returning the read-only availability fact, and add coverage for a successful ls-remote following a git-ownership/git-permission fetch failure.

[alexgunsberg]

Superseded by #83181 which integrates this PR's structured _git_run / check_for_updates_details / ownership + Dashboard facts and the v2 shallow safety contract (no passive lock unlinks, absolute depth target, fail-closed FETCH_HEAD).

Closing as duplicate/superseded so the two patches cannot overwrite each other. Branch/head preserved if anything needs cherry-picking.

[alexgunsberg]

Superseded by #83181 (integrated + shallow safety v2).