fix: invalidate stale update-check cache when refs change

[hcl271021632-creator]

Bug Description

hermes --version could report an old "N commits behind" value even after the local checkout had already been updated outside hermes update.

Root Cause

The update-check cache only stored a timestamp and the cached behind count. As long as the cache was still fresh, Hermes trusted it without verifying that HEAD and origin/main still matched the refs from when the cache was written.

Fix

• store HEAD and origin/main hashes alongside the cached behind count
• only trust a fresh cache entry when both refs still match current git state
• refresh the cache immediately when either ref changed
• add regression tests for matching refs, mismatched refs, and expired cache behavior

How to Verify

1. Run python3.11 -m pytest tests/hermes_cli/test_update_check.py -o 'addopts=' -q\n2. Remove ~/.hermes/.update_check and run python3.11 -m hermes_cli.main --version\n3. Confirm Hermes reports Up to date when HEAD == origin/main, instead of reusing a stale behind count\n\n## Test Plan\n\n- [x] Added regression test for this bug\n- [x] Existing targeted tests still pass\n- [x] Manual verification of the fix\n\n## Risk Assessment\n\nLow — the change is limited to update-banner cache validation and only affects version/update status reporting.

[teknium1]

Thanks for identifying the stale update-status path. The premise remains valid on current main: hermes_cli/banner.py:330-344 accepts a fresh source-checkout cache without comparing the live checkout HEAD or local upstream state.

Problems

• The patch targets an older monolithic update-check implementation. Current main delegates source checkouts through hermes_cli/banner.py:194-251 to preserve official-SSH and shallow-clone behavior, so the submitted fetch/rev-list body cannot be applied directly.
• Current main also protects pip/Nix cache correctness with rev and ver at hermes_cli/banner.py:330-365; the salvaged cache schema must retain those keys alongside any local-ref fingerprint.

Suggested changes

• Integrate the ref validation into the current cache guard while continuing to call _check_via_local_git for source checkouts.
• Cover a fresh cached result followed by a changed HEAD, plus preservation of the existing version and shallow-clone paths in tests/hermes_cli/test_update_check.py.

Automated hermes-sweeper review.