refactor(pm): pm owns the dependency-environment layout and interpreter paths

hermes_cli.runtime_paths (venv generations, selection, activation) moves to
pm.environments, and gains venv_bin_dir / venv_python / project_python. Every
in-tree caller asks pm for an interpreter now; pm no longer reaches back into
hermes_cli for its own environment layout (pm.packages, pm.extras, pm.ensure,
pm.paths imported hermes_cli.runtime_paths). The three open-coded
"Scripts/python.exe or bin/python" ladders in pm collapse onto venv_python.

hermes_constants.venv_python_path / venv_bin_dir and hermes_cli.runtime_paths
stay as frozen-updater-surface shims only (tests/compat/old_updater_surface.json).

To keep the boot path light, pm/__init__ resolves its facade lazily (PEP 562)
and pm.registry loads the built-in package definitions on first read instead of
at import: `import hermes_bootstrap` now loads pm + pm.environments only (25ms,
was 37ms with the eager facade dragging in the downloader). The stripped-payload
fixtures that ship only pre-import files keep working for the same reason.

Also restores two frozen-surface re-exports the F401 sweep dropped
(banner._github_compare_behind, cua_backend.resolve_cua_driver_cmd).

scripts/_activation.py

@@ -35,7 +35,7 @@ free of both the exec bit and a ``PATH`` lookup.
 
 Activation is not re-run when the inherited environment is still current: the
 sentinel's value is the installed-state file the environment was composed
-against (see ``hermes_cli.runtime_paths.activation_environment``), so the
+against (see ``pm.environments.activation_environment``), so the
 prologue compares it against the inputs that decide the dependency set. Any of
 ``uv.lock``, ``pyproject.toml`` or ``pm/lock.json`` being newer than that file
 means the inherited environment predates its inputs, and the prologue

scripts/ci/setup_toolchain.py

@@ -182,7 +182,7 @@ def dependencies(args) -> None:
         return
     import tomllib
 
-    from hermes_cli.runtime_paths import selected_venv
+    from pm.environments import selected_venv
     from pm import build_environment, check_project_lock, sync_venv
     from pm.paths import repo_root