HW-03: retain the installed interpreter for workflow runs

[skylarbpayne]

Summary

• adds the isolated installed-interpreter/environment resolver consumed by the later INT-C1 CLI adapter;
• reports safe package origin/version/manifest identity, registry fingerprint, visible uv, and DB alias without leaking the full environment;
• adds a clean built-wheel → temporary venv smoke using the HW-20 typed quickstart and FND-PKG manifest seam;
• specifies that INT-C1, not this packet, owns shared CLI deletion/wiring. No shared parser, registry-v2 catalog, install command, plugin payload, or live environment changed.

TDD receipt

Expected red was observed before implementation:

$ uv run pytest -q tests/test_installed_cli_environment.py
E   ModuleNotFoundError: No module named 'hermes_workflows.installed_environment'
1 error in 0.11s

Green:

$ uv run pytest -q tests/test_installed_cli_environment.py
5 passed in 3.46s

Clean-wheel / venv transcript

$ python tests/probes/installed_cli_smoke.py
{
  "status": "waiting",
  "waiting_on": "signal:operator.response:review_release_note",
  "python_executable": "/var/folders/.../probe/venv/bin/python",
  "installed_cli_path": "/var/folders/.../probe/venv/bin/hermes-workflows",
  "installed_cli_shebang": "#!/var/folders/.../probe/venv/bin/python",
  "interpreter_under_venv": true,
  "package_origin": "/private/var/folders/.../probe/venv/lib/python3.11/site-packages/hermes_workflows/installed_environment.py",
  "package_origin_under_venv": true,
  "visible_uv": "/var/folders/.../probe/fake-bin/uv",
  "fake_uv_visible": true,
  "fake_uv_called": false,
  "hidden_bypasses_used": [],
  "db_alias": "smoke-db",
  "registry_sha256": "aad6a8614967b60ebdd8fd349cbc2612c8fd8063ae613186a96c1d4b3f4417ee",
  "fixture_sha256": "aad6a8614967b60ebdd8fd349cbc2612c8fd8063ae613186a96c1d4b3f4417ee",
  "package_manifest_sha256": "f0b01517dc3f30c5cbc66fe5cdd8d86fed566be43c1b40c374a961374de09ec3",
  "wheel_sha256": "0202e4112a5d114a770b27530eb4d11b89bb924826e05d11a3bacd0a07a358bc"
}

The probe builds hermes_workflows-0.0.1-py3-none-any.whl, installs it with pip --no-deps into a fresh venv, removes inherited PYTHONPATH, puts a marker-writing fake uv first on PATH, starts the packaged typed quickstart, drains it through the installed console script, reads status through the installed console script, and verifies the marker was never created.

Verification

$ uv run pytest -q tests/test_package_resource_contract.py tests/test_typed_quickstart_contract.py
54 passed in 2.05s

$ uv run --isolated --python 3.9 pytest -q tests/test_installed_cli_environment.py tests/test_package_resource_contract.py tests/test_typed_quickstart_contract.py
59 passed in 9.19s

$ uv run --isolated --python 3.11 pytest -q tests/test_installed_cli_environment.py tests/test_package_resource_contract.py tests/test_typed_quickstart_contract.py
59 passed in 7.23s

$ uv run --isolated --python 3.9 pytest -q
664 passed, 1 skipped in 41.53s

$ uv run --isolated --python 3.11 pytest -q
663 passed, 2 skipped in 35.96s

$ git diff --check ba3b1fc1015a76f02acced6e7aee7b89b4a40d14...HEAD
# no output

Immutable receipts and scope

• base: ba3b1fc1015a76f02acced6e7aee7b89b4a40d14
• head: 5f1be3b7a938b78b38cd1e1456f94368e5ca9ccf
• required ancestors: FND-PKG e1e7a09e0c52702b4ab93e9a70520fd5ede4f9e3, HW-20 88d52e315f9a6ab90639711ac5c85d416de6da33, INT-D1 ba3b1fc1015a76f02acced6e7aee7b89b4a40d14
• excluded PR feat: support custom select values in review queue #131 head fc9eb5ae0797c5cbdfcf51d6b9be551e6ba85331: confirmed not an ancestor
• exact five-path allowlist: confirmed

docs/operations/installed-environment.md
src/hermes_workflows/installed_environment.py
tests/fixtures/install_smoke_registry_v2.json
tests/probes/installed_cli_smoke.py
tests/test_installed_cli_environment.py

Integration and rollback

INT-C1 owns removal of the shared implicit uv trampoline and private parser bypasses, plus wiring this resolver into the public run path. This packet does not claim issue integration by itself.

Rollback may remove this isolated seam only while it is unconsumed. It must not restore implicit uv execution or environment stripping; any future project-environment runner must be an explicit, separately documented command.

Do not merge until the separate HW-03 SR and QR pass.