fix(update): reuse lifecycle lease for Hermes refresh

[ScriptedAlchemy]

Summary

• reuse post-update exclusive profile authority during Hermes legacy migration
• prevent Hermes refresh failure from leaving version markers empty and retriggering every host install on ordinary commands
• preserve the standalone migration path while adding an explicit under-lease boundary

Production repro

On the GitHub-installed v0.0.70 binary, tracedecay update reported agent install failed for: hermes; subsequent commands repeated every host integration refresh. Direct Hermes install failed with cannot start legacy Hermes store migration: daemon service install is already active while the live daemon held the profile lifecycle lease.

Verification

• regression test observed red before implementation: missing under-lease migration boundary
• 30/30 Hermes migration tests
• 22/22 update orchestration tests
• cargo check -p tracedecay-migrate --all-features
• cargo clippy -p tracedecay --bin tracedecay --all-features -- -D warnings
• cargo fmt --all -- --check
• git diff --check

No generated or dashboard build artifacts are committed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 69ea75c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR