fix: read plugin-home config through the loader; register update export

The config-read guard forbids raw yaml loads of config.yaml outside owner
modules, and hermes_cli.main's frozen lazy-export surface must list every
update_cmd symbol it proxies.

hermes_cli/main.py

@@ -2136,7 +2136,7 @@ _FROZEN_UPDATER_SURFACE: dict[str, tuple[str, ...]] = {
         "_ledger_reapable_backend_pids", "_leftover_pausable_gateway_pids", "_npm_lockfile_changed",
         "_orphaned_desktop_backend_pids", "_park_stashed_changes",
         "_pause_windows_gateways_for_update", "_print_parked_branch_kept_notice",
-        "_print_parked_branch_skip_warning",
+        "_print_parked_branch_skip_warning", "_reapply_plugin_python_dependencies",
         "_refresh_active_lazy_features", "_refresh_active_memory_provider_dependencies",
         "_refresh_bootstrap_cache_scripts", "_refresh_windows_gateway_launchers",
         "_relaunch_stopped_serves",

hermes_cli/plugin_python_deps.py

@@ -200,11 +200,14 @@ def _plugin_enabled(decl: PythonDeclaration, enabled: set[str], disabled: set[st
 
 
 def _read_home_config(home: Path) -> dict:
-    path = home / "config.yaml"
-    if not path.is_file():
-        return {}
-    data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-    return data if isinstance(data, dict) else {}
+    """*home*'s effective config through the real loader, scoped to that home for the duration."""
+    from hermes_cli.config import load_config_readonly
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+    token = set_hermes_home_override(home)
+    try:
+        return load_config_readonly()
+    finally:
+        reset_hermes_home_override(token)
 
 
 def enabled_declarations(home: Path) -> list[PythonDeclaration]: