Bug Description

hermes update could fail to rebuild the WebUI when the parent environment exported NODE_ENV=production.

In that scenario, npm omitted devDependencies, so the frontend build failed with tsc: command not found and the update finished with the WebUI unavailable.

Root Cause

The WebUI build path used deterministic npm install logic without explicitly including dev dependencies.

That was unsafe because the frontend build depends on tooling from devDependencies (notably TypeScript/Vite), while NODE_ENV=production causes npm to omit them by default.

Fix

• add an include_dev flag to _run_npm_install_deterministic()
• force npm ci --include=dev / npm install --include=dev for the WebUI build path
• add regression coverage for both install paths and the WebUI build invocation

How to Verify

1. Export NODE_ENV=production
2. Run the WebUI build flow
3. Confirm the build succeeds instead of failing with tsc: command not found

Test Plan

• Added regression test for this bug
• Existing focused tests pass
• Manual verification of the fix

Validation performed:

• NODE_ENV=production npm run build passed after the fix
• python -m pytest tests/hermes_cli/test_web_ui_build.py -q -o addopts='' → 13 passed

Risk Assessment

Low — the change only affects the frontend build dependency install path and makes the WebUI build explicit and deterministic under production-like environments.