fix(update): install lockfile tools before the launch-time sync too

prepare_launch finishes an interrupted update, or a hand-run git pull, by
syncing the venv at startup. It skipped the required-tool step that
`hermes update` now runs first, so a bumped ripgrep/ffmpeg/python pin stayed
uninstalled and activation warned on every start.

hermes_cli/venv_sync.py

@@ -290,8 +290,12 @@ def _finish_source_update(root: Path, *, current: bool, pending: Path) -> None:
         arm_completion(root)
         # Main-era installs have no PM ledger; carry what their venv held.
         # Established PM installs retain their recorded extras and plugin union instead.
+        from pm.client import ensure_tools_for_sync
         from pm.extras import legacy_selection
         extras = legacy_selection(root) if not runtime_facts_path(root).is_file() else None
+        # Same order as `hermes update`: an interrupted update or a hand-run
+        # `git pull` leaves this tree's lockfile ahead of the installed tools.
+        ensure_tools_for_sync()
         pm.sync_venv(extras, explicit=True, project_root=root)
         collect_superseded_generations(root)
         # These can predate the swap. Once PM commits the replacement they

tests/hermes_cli/test_update_launch_completion.py

@@ -13,6 +13,14 @@ from hermes_cli import venv_sync
 from pm.environments import runtime_facts_path
 
 
+@pytest.fixture(autouse=True)
+def _no_tool_downloads(monkeypatch):
+    """The launch sync publishes lockfile tools first; these tests cover the sync decision."""
+    import pm.client
+
+    monkeypatch.setattr(pm.client, "ensure_tools_for_sync", lambda: None)
+
+
 @pytest.fixture
 def completion_tail(monkeypatch):
     """Record the source-completion child prepare_launch spawns after a sync instead of running it.