Summary

• export VIRTUAL_ENV=sys.prefix when _cmd_update_pip() is running inside a real virtualenv
• keep system-Python installs unchanged by only applying the env overlay when sys.prefix != sys.base_prefix
• add a regression test covering the launcher-shebang case where Hermes runs from a venv interpreter but the shell environment lacks VIRTUAL_ENV

Why

hermes update could fail for PyPI installs launched from a venv-backed shim because uv pip install --upgrade hermes-agent inherited a shell without VIRTUAL_ENV, even though the running interpreter already knew its venv root via sys.prefix.

Verification

• uv run --frozen --with pytest-timeout pytest tests/hermes_cli/test_cmd_update.py
• git diff --check
• uv run --frozen ruff check hermes_cli/main.py tests/hermes_cli/test_cmd_update.py

Scope

• Fixes hermes update fails with 'No virtual environment found' when launcher venv is not active in shell #35031
• Intentionally does not change non-virtualenv / system-Python update behavior