npm and go install run third-party package code; they now start from
hermes_subprocess_env() instead of a full os.environ copy (go keeps
GOBIN, npm keeps the Hermes-managed Node path).
Ported from #55556 onto current main; the pip path now provisions
through pm.ensure_python_tool and is not part of this change.