INT-C1: retain the installed interpreter in CLI runs

[skylarbpayne]

Summary

• routes public hermes-workflows run directly through the environment that installed the console script
• consumes the merged HW-03 installed-environment resolver and removes the implicit uv subprocess trampoline
• deletes the private _run-engine, --direct, and HERMES_WORKFLOWS_UV_CHILD bypass contract
• updates the canonical README/setup guidance and regression coverage

Base and consumed contracts

• refreshed base / qualified RC-CI-GUARD main: fc423c13e46049a3ac3928da2008523abc0fe4d9
• mechanical merge commit: cedd3be81c59a33fc319af055ac7fb16e47cc6c1
• original INT-C1 head retained as first parent: 02f201c538a614b5df585f0d6f4559bd9f9e4bf4
• RC-04 base: 1979089e8f6b23241939b1bd63e14fe1007f62bc
• FND-PKG: e1e7a09e0c52702b4ab93e9a70520fd5ede4f9e3
• INT-D1: ba3b1fc1015a76f02acced6e7aee7b89b4a40d14
• HW-03 merge: d99da904455a33a0406062289cad5ce5cea17fe2
• HW-03 reviewed implementation: afcefc08e3354d97b8edad8f948bf8cd4d690ec7
• excluded PR feat: support custom select values in review queue #131 head fc9eb5ae0797c5cbdfcf51d6b9be551e6ba85331 is not an ancestor

TDD receipt

Red:

uv run pytest -q tests/test_cli.py::test_hermes_workflows_run_retains_installed_interpreter_without_invoking_uv
1 failed: fake uv was invoked and returned exit 97

Green:

uv run pytest -q tests/test_cli.py::test_hermes_workflows_run_retains_installed_interpreter_without_invoking_uv tests/test_uv_run_contract.py
3 passed in 0.25s

Focused CLI + installed-environment + typed quickstart/public-doc regressions:

uv run pytest -q tests/test_installed_cli_environment.py tests/test_cli.py tests/test_uv_run_contract.py tests/test_typed_quickstart_contract.py tests/test_public_facade.py tests/test_launch_examples.py
77 passed in 24.72s

Clean wheel / installed CLI / fake-uv receipt

A clean wheel was built, installed with --no-deps into a fresh temporary venv, and invoked through <temp-venv>/bin/hermes-workflows with a marker-writing fake uv first on PATH.

{"wheel_sha256":"d334aaacf24c7597007de14681d6e56939003544df82f258817db79a33b70c3e","installed_cli_shebang":"#!<temp-venv>/bin/python","python_executable":"<temp-venv>/bin/python","interpreter_under_venv":true,"package_origin_under_venv":true,"fake_uv_visible":true,"fake_uv_called":false,"public_run":{"status":"running","waiting_on":null},"public_worker":{"status":"waiting","waiting_on":"signal:operator.response:review_release_note"},"public_status":{"status":"waiting","waiting_on":"signal:operator.response:review_release_note"}}

A second assertion pass against the installed CLI exited 0 with the same under-venv interpreter, typed wait, and absent fake-uv marker.

Python matrix

Python 3.9 focused: 77 passed in 28.01s
Python 3.9 full:    676 passed, 1 skipped in 49.58s
Python 3.11 focused: 77 passed in 25.27s
Python 3.11 full:    675 passed, 2 skipped in 42.32s

Exact scope

git diff --check is clean. fc423c13...HEAD changes exactly this closed five-path allowlist:

• src/hermes_workflows/cli.py
• tests/test_cli.py
• tests/test_uv_run_contract.py
• README.md
• docs/setup-for-agents.md

No runtime core, registry, plugin/dist, package metadata, Palmer repository, or live .hermes/** paths changed.

GitHub checks

Terminal state at refreshed exact head cedd3be81c59a33fc319af055ac7fb16e47cc6c1:

• build: pass
• pytest (3.9): pass
• pytest (3.11): pass
• release-candidate: pass
• deploy: skipped as expected

The qualified RC-CI-GUARD classified this exact five-path runtime diff as non-RC scope. The release-candidate job completed successfully after checkout and classification; its old-RC build, byte/identity verification, and artifact upload steps were skipped. .github/workflows/test.yml is byte-for-byte the qualified main version and is absent from the PR's net diff.

Rollback

Revert this adapter commit only if needed, but do not restore implicit uv execution, environment stripping, or the hidden bypass contract. Any future project-specific environment runner must be an explicit separate command.

Live-state boundary

No live profile install, registry/database mutation, worker/service restart, deploy/cutover, cron change, or other live mutation was performed. Do not merge before separate INT-C1 specification and quality reviews.