fix(pm): skip the tool re-hash during shell activation

source ./activate and . .\activate.ps1 always run setup, and setup always
runs `python -m pm.cli install`. An explicit install re-hashes every
published tool entry so it can repair a corrupted one. On this machine
that hash reads about 550 MiB and takes 6.0 of the 6.6 seconds, even
when nothing changed.

Shell activation now passes --trust-recorded and trusts the digest the
install recorded, the same check startup already uses. A missing tool
is still installed and a stale venv is still rebuilt. `hermes pm
install` and `hermes update` keep the byte check, and the flag refuses
names, --extra, and --target so it cannot narrow an install someone
asked for by name.

Measured on this machine, already up to date: the activation path drops
from 6.6 s to 0.9 s. A bare `python -m pm.cli install` stays at 7.2 s.
The remaining 0.9 s is process startup and imports, not hashing.

website/docs/reference/package-management.md

@@ -319,9 +319,11 @@ The leading dot and space in PowerShell are required. Executing
 The POSIX script uses Bash syntax. Use Bash for this recipe rather than `sh`,
 fish, or assuming that a Zsh startup file has Bash semantics.
 
-Each activation invokes PM's install/sync path. PM reuses current tools and
-dependency generations; missing or stale inputs can require downloads and a
-rebuild. A setup failure returns an error before changing the activated shell
+Each activation invokes PM's install/sync path and trusts the recorded tool
+digest instead of re-hashing every entry. PM still installs a missing tool and
+rebuilds a stale dependency generation; a deliberate install keeps the byte
+check. Run `python -m pm.cli install` or `hermes update` to re-check realized
+bytes. A setup failure returns an error before changing the activated shell
 environment, including when re-sourcing an already active environment.
 
 After sync, activation prepends installed PM tools to `PATH` and sets