Clean stale stub-era comments and fallback harness paths

[thinmintdev]

What to build

Several comments and harness fallbacks still describe old stub-era behavior even though the implementation has moved on. Clean them up so future audits do not mistake stale comments for current placeholders.

Known examples:

• Hermes provisioner comments still describe all phases as no-op stubs and keeps an unused _stub helper.
• release-test still checks whether the update CLI is a stub and can defer real updater failures.
• api/init.py comments overstate MCP lifecycle mutations as 501 stubs.
• dev-bootstrap can start a fake OK server when hal0 is not importable, which may hide broken imports.
• installer placeholder-SHA fallback/docs appear stale now that FLM_DEB_SHA256 is pinned.

Acceptance criteria

• Stale stub-era comments are removed or rewritten to describe current behavior.
• Harness checks fail on real updater/import failures instead of classifying them as old stub deferrals.
• Any intentionally retained fallback is documented as an active supported path.
• Tests or harness dry-runs cover the updated behavior where practical.

Blocked by

None - can start immediately