fix(update): let callers pass the platform verdict to the venv helpers

CI slice 8/8 red:

  test_verify_core_dependencies.py::test_uses_virtual_env_from_environment
  AssertionError: assert None == PosixPath('.../newvenv/Scripts/python.exe')

The Phase 2 reviewer flagged this exact risk (W4) and I under-weighted it as
"latent, not broken". It was neither — it was already failing.

The suite exercises Windows-only paths on Linux CI by patching predicates
(`hermes_cli.main._is_windows`, `is_windows`, `platform.system`). Routing
those call sites through a helper that reads `sys.platform` unconditionally
meant the patches no longer reached the path derivation: the test built
`Scripts/python.exe` while the code looked for `bin/python`.

venv_bin_dir/venv_python_path now take an optional `windows=` verdict,
defaulting to the host. Every converted site passes its own predicate, so
the patched-predicate coverage is restored — the dedup keeps the layout in
one place without hijacking the platform decision.

Verified by causation: dropping `windows=` reproduces the CI failure exactly;
restoring it goes green. Added two regression tests, including one asserting
a patched `_is_windows` still reaches the derivation.

hermes_cli/managed_uv.py

@@ -386,7 +386,7 @@ def update_managed_uv(
 def _venv_python(venv_dir: Path) -> Path:
     from hermes_constants import venv_python_path
 
-    return venv_python_path(venv_dir)
+    return venv_python_path(venv_dir, windows=platform.system() == "Windows")
 
 
 def _remove_tree(path: Path, *, boundary: Path) -> None: