test(update): the host obligation is host-scoped state, so each test must discharge it

Rebasing onto main turned 21 tests red in four files whenever the operator supplies
HERMES_GATEWAY_LOCK_DIR. Not a behaviour collision: the record this PR introduces lives in
the per-OS-USER host state dir, and the root conftest pins that dir per test only when the
caller supplied nothing (#118097 deliberately keeps the documented override working). With
one supplied, every test in a file shares the dir, so a case that arms the obligation makes
the next case read a restart it never owed.

Clearing the record around each hermes_cli test — rather than re-pinning the dir — fixes the
leak without touching #118097's resolution rule or any expectation.

tests/hermes_cli/conftest.py

@@ -82,6 +82,32 @@ def _inline_post_swap_handoff(request, monkeypatch):
     monkeypatch.setattr(update_cmd, "_hand_off_post_swap", _inline, raising=False)
 
 
+@pytest.fixture(autouse=True)
+def _discharge_host_update_obligation():
+    """Start and end every ``hermes_cli`` test with NO host update-restart obligation.
+
+    The record is host-scoped on purpose (one multiplexer per host), so it lives in the
+    per-OS-USER host state dir — not in the per-test ``HERMES_HOME``. The root conftest pins
+    that dir per test only when the caller supplied no ``HERMES_GATEWAY_LOCK_DIR`` (#118097
+    keeps the documented override working), so with one set every test in a file shares it and
+    a test that arms the obligation makes the next one read a restart it never owed. Clearing
+    the record — rather than re-pinning the dir — leaves that override rule untouched.
+    """
+
+    def _clear() -> None:
+        try:
+            from hermes_cli.update_host_obligation import clear_host_obligation
+
+            clear_host_obligation()
+        except Exception:
+            # Import/env failure here must never error an unrelated test.
+            pass
+
+    _clear()
+    yield
+    _clear()
+
+
 @pytest.fixture
 def isolated_update_runtime(monkeypatch, tmp_path, request):
     """Keep mocked updater flows off the host checkout and runtime fleet."""