fix(update): keep --finish-update through the completion self re-exec

source_completion.py re-execs itself into PM's selected interpreter before
touching any product, and the passthrough argv only carried --desktop. So
the startup heal's --finish-update was dropped, and the prepared invocation
fell through to the install tail: an update reported itself as an install.

    ✓ Install complete! [main @ c4056e3d6b]

Every flag that decides WHICH tail runs has to survive that boundary.

Verified with a stub that captures the bootstrap command instead of running
it: --finish-update present in the re-exec, --desktop still passed, and
without the flag the install path is unchanged. File compiles.

hermes_cli/source_completion.py

@@ -113,7 +113,12 @@ def main(argv: list[str] | None = None) -> int:
 
     from hermes_cli.runtime_paths import activation_environment
 
-    command = _bootstrap_command(root, ["--desktop"] if args.desktop else [])
+    # This interpreter is a bootstrap one: the work happens in the re-exec, so
+    # every flag that decides WHICH tail runs has to survive into it. Losing
+    # --finish-update here silently reports an update as an install.
+    passthrough = (["--desktop"] if args.desktop else []) + \
+                  (["--finish-update"] if args.finish_update else [])
+    command = _bootstrap_command(root, passthrough)
     return subprocess.call(command, cwd=root, env=activation_environment(root))