feat(dev): self-activating scripts with a stale-aware activation sentinel

Repo scripts assume the PM-activated environment, so running one without
activation fails much later with a confusing ImportError. Add the two halves
covering both invocation paths:

- scripts/_activation.py: require_activation() exits immediately, naming the
  exact command for the caller's shell (source ./activate on POSIX,
  . .\activate.ps1 on a native Windows host), before any heavy import.
- scripts/_hermes-python: the POSIX shebang target. `#!/usr/bin/env -S bash -c
  '...'` hands itself the target path through bash -c's $0, sources activate,
  then execs the interpreter on the same file -- so tracebacks and __file__
  still point at the real script and ./scripts/foo.py works from any cwd with
  no manual source.

__HERMES_ACTIVATED changes from a bare "1" to the installed-state file the
environment was composed against, so one value carries activation, which
checkout activated it, and a staleness stamp. The prologue compares that file
against uv.lock / pyproject.toml / pm/lock.json with the `-nt` builtin -- no
process spawn -- and re-activates once when the inherited environment predates
its inputs. pm rewrites that file only on a real sync, so the check settles
back to current rather than re-syncing on every run.

A legacy "1" keeps working: require_activation() tests non-emptiness, and the
prologue's [ -e ] fails on it, so it activates once and upgrades.

activate

@@ -62,7 +62,9 @@ _hermes_keys="$(printf '%s' "$_hermes_json" | "$_hermes_py" -c 'import json,sys;
 [ -n "$_hermes_keys" ] || _hermes_keys="PATH"
 
 # --- snapshot what we are about to change (deactivate restores this) ---
-__HERMES_ACTIVATED=1
+# __HERMES_ACTIVATED is part of the composed env below (it carries the
+# installed-state path this environment was built from), so it is snapshotted
+# and exported with every other key — no separate assignment here.
 __HERMES_SAVED_PATH="$PATH"
 for _hermes_k in $_hermes_keys; do
     eval "__HERMES_SAVED_$_hermes_k=\"\${$_hermes_k+set}\""