feat: add governed Hermes builder dispatch capability (refreshed)

[fanuman123]

Replacement for #84333

GitHub's generated head ref for #84333 remained pinned to the old commit after the fork branch advanced. This PR uses a fresh branch pointer to the exact reviewed replacement head.

• Current head: 17a1af49a3b0382eee41414e4a51e8de399b326c
• Historical discussion and original automated review: feat: add governed Hermes builder dispatch capability #84333
• No code or history was changed to refresh the PR.
• Current upstream main: 13ce0c5c675e843af70d19c9e5144249cd51c8d1
• GitHub reports this PR conflict-free.

Review findings addressed

• worker identity probe failures now roll back transactionally and return a controlled error;
• empty worker tool allowlists are rejected;
• downstream update guard has an explicit, warned operator recovery override;
• process-group reuse/fail-closed semantics are documented;
• task and governance snapshots are kept distinct in completion evidence;
• updater test harnesses are isolated from inherited downstream guard state.

Validation

• focused follow-up suite: 69 passed, 1 skipped
• adjacent suite: 163 passed, 2 skipped
• broad no-live matrix: 751 passed, 5 skipped
• Ruff and diff checks: passed
• final-head live canary and Stage-1 integration: passed
• downstream exact-head operator CI 32240555743: passed
• Docker 32240554942: passed
• Nix 32240555013: passed

Upstream CI, Docker, and Nix are currently action_required because GitHub requires a repository maintainer to authorize workflows from a fork. This is an approval gate, not a test failure.

This remains unmerged and has not been self-approved.

[alt-glitch]

This was generated by AI during triage.

This is a refreshed-head replacement for the still-open #84333 with the same governed builder-dispatch feature. Please consolidate review on the current replacement and decide whether #84333 should be closed.