Port of main's guard into update_cmd_validation: the probe child sets
sys.argv to the updater's contract before importing hermes_cli.main, so the
startup dotenv load does not run op/bws/command helpers. Tests follow the
validation module and the run_completion seam; the unused
isolated_update_runtime fixture referenced retired names and goes.