fix(tests): repair the two Linux-lane CI failures on this branch

Both failed only in the full Linux suite, which the targeted local
battery never ran:

- test_update_zip_two_phase.py's AST guard (#76105) flags any code
  literal "Scripts" in hermes_cli as an open-coded venv layout.
  migrate_windows_bin_path's legacy PATH key now derives it via
  venv_bin_dir(root / "venv", windows=True) — same value, canonical
  helper. The literal `venv` component stays: the key must match what
  the pre-#83797 installer wrote to the registry, not where the venv
  lives now.
- The managed-bin marker tests built expected PATH entries from
  tmp_path, so on a POSIX host they compared forward-slash strings
  against the backslash markers and could never match. Markers match
  Windows registry PATH entries, so the tests now feed Windows-shaped
  literals — host-independent, same contract.

hermes_cli/_install_repair.py

@@ -395,7 +395,7 @@ def migrate_windows_bin_path(
     root = Path(root)
 
     # Same per-machine anchor as ensure_windows_bin_launchers (see there).
-    from hermes_constants import get_default_hermes_root
+    from hermes_constants import get_default_hermes_root, venv_bin_dir
 
     try:
         home = Path(get_default_hermes_root())
@@ -425,7 +425,11 @@ def migrate_windows_bin_path(
 
     legacy_keys = {
         _normalize_windows_path(root / "bin"),
-        _normalize_windows_path(root / "venv" / "Scripts"),
+        # The pre-#83797 installer put the venv's Scripts dir itself on PATH,
+        # always at the literal `venv` layout (never `.venv`) — this strips
+        # that stale entry, so it must match what the installer wrote then,
+        # not where the venv lives now.
+        _normalize_windows_path(venv_bin_dir(root / "venv", windows=True)),
     }
     home_bin_key = _normalize_windows_path(home_bin)
 

tests/hermes_cli/test_uninstall_windows_bin_launchers.py

@@ -90,21 +90,27 @@ def test_launcher_names_stay_in_lockstep_with_install_ps1():
 
 
 class TestManagedBinPathMarker:
-    """The managed ``bin`` PATH entry goes only when the dir itself goes."""
+    """The managed ``bin`` PATH entry goes only when the dir itself goes.
 
-    def test_keep_data_markers_spare_the_managed_bin(self, tmp_path: Path):
-        home = tmp_path / "hermes"
-        markers = [m.lower() for m in uninstall._hermes_path_markers(home)]
+    Markers match against Windows registry PATH entries, so the inputs here
+    are Windows-shaped path strings regardless of the host — feeding
+    ``tmp_path`` would make the test pass only on Windows hosts.
+    """
 
-        bin_key = str(home / "bin").lower()
-        assert not any(bin_key.startswith(m) for m in markers)
+    HOME = r"C:\Users\me\AppData\Local\hermes"
+    BIN_ENTRY = r"C:\Users\me\AppData\Local\hermes\bin"
 
-    def test_full_wipe_markers_take_the_managed_bin(self, tmp_path: Path):
-        home = tmp_path / "hermes"
+    def test_keep_data_markers_spare_the_managed_bin(self):
+        markers = [m.lower() for m in uninstall._hermes_path_markers(Path(self.HOME))]
+
+        assert not any(self.BIN_ENTRY.lower().startswith(m) for m in markers)
+
+    def test_full_wipe_markers_take_the_managed_bin(self):
         markers = [
             m.lower()
-            for m in uninstall._hermes_path_markers(home, include_managed_bin=True)
+            for m in uninstall._hermes_path_markers(
+                Path(self.HOME), include_managed_bin=True
+            )
         ]
 
-        bin_key = str(home / "bin").lower()
-        assert any(bin_key.startswith(m) for m in markers)
+        assert any(self.BIN_ENTRY.lower().startswith(m) for m in markers)