fix(integration): restore subprocess stdin=DEVNULL / utf-8 encoding guards and windows-footgun gates dropped by round-3 compaction

Repo scanners (check_subprocess_stdin, check-windows-footguns --all) flagged 21 sites where
the r3 single-line collapses lost stdin=DEVNULL, encoding='utf-8'/errors='replace', the
'# windows-footgun: ok' same-line marker, or the getattr(os, 'geteuid') gate. Each guard is
restored at the call site (real portability/hang fixes, not suppressions).

hermes_cli/_secrets_common.py

@@ -94,8 +94,8 @@ def print_table(console: Console, columns: Sequence, rows: Iterable,
 def cli_version(binary: Path) -> str:
     """Return the first line of ``<binary> --version`` or ``"version unknown"``."""
     try:
-        res = subprocess.run([str(binary), "--version"], capture_output=True, text=True,
-                             encoding='utf-8', errors='replace', timeout=5)
+        res = subprocess.run([str(binary), "--version"], capture_output=True, text=True, encoding='utf-8',
+                             errors='replace', timeout=5)
         if res.returncode == 0:
             return (res.stdout or res.stderr).strip().splitlines()[0]
     except (OSError, subprocess.TimeoutExpired):