test(docker): the image allows opt-in installs now

72df5aa60e dropped HERMES_DISABLE_LAZY_INSTALLS=1 from the image: opt-in
extras install into PM generations under $HERMES_HOME, never the sealed
/opt/hermes tree. The hosted write-policy smoke test still required the
refusal, so the desktop/amd64 image job failed. Assert it is unset.

tests/docker/test_immutable_install.py

@@ -6,7 +6,7 @@ Build the real image and verify at runtime:
   2. A stale "docker" stamp in $HERMES_HOME is healed (removed) on boot
 
 The hosted write-policy env (PYTHONDONTWRITEBYTECODE,
-HERMES_DISABLE_LAZY_INSTALLS, ...) is covered by
+HERMES_WRITE_SAFE_ROOT, ...) is covered by
 test_immutable_install_permissions.py.
 """
 from __future__ import annotations

tests/docker/test_immutable_install_permissions.py

@@ -9,7 +9,9 @@ def test_container_sets_hosted_write_policy_env(built_image: str) -> None:
     script = (
         'test "$HERMES_HOME" = "/opt/data" && '
         'test "$HERMES_WRITE_SAFE_ROOT" = "/opt/data" && '
-        'test "$HERMES_DISABLE_LAZY_INSTALLS" = "1" && '
+        # Opt-in extras install into PM generations under $HERMES_HOME, never
+        # the sealed /opt/hermes tree, so the image must not refuse them.
+        'test -z "${HERMES_DISABLE_LAZY_INSTALLS:-}" && '
         'test "$PYTHONDONTWRITEBYTECODE" = "1"'
     )
     result = subprocess.run(