Class C6 (bricked installs / stale modules after hermes update): every module the
package ships is imported from a clean first-party sys.modules in a fresh sandboxed
interpreter; a stale-graph leg replays the pre-handoff v2026.9.14 updater graph and
imports the post-purge restart modules (file_signature burst #111942 class); and a
matrix of real entrypoints (--version, doctor, -z one-shot against the fake provider
with state.db integrity_check, serve READY on stdout + clean SIGTERM with no orphan,
console scripts) runs in fresh processes. Every process is bubblewrap-sandboxed (own
PID namespace, no user systemd bus, real ~/.hermes read-only) so no probe can reach a
live install.
(cherry picked from commit 6635ace39ae6c04d9391da7e1321277a28f8b219)
15879fde29