fix(test): make lazy-secrets update-check E2E tests network-independent

tests/test_lazy_secrets_dispatch.py::TestUpdatePathE2E ran the real
`hermes update --check` bare, so the child's `git fetch origin main`
hit github.com on every CI run. During the 2026-08-17 GitHub incident
the fetch stalled past the 30s subprocess timeout and both update tests
went red on main for hours with zero code change (slices seen on runs
32003200300 and 32011520139).

These tests assert the lazy-crypto / no-self-lock dispatch invariants,
not update connectivity. Rewrite all git remote URLs in the child to an
unreachable file:// path via GIT_CONFIG_* env overrides: the update path
still exercises its full parser/dispatch/fetch code, but the fetch now
fails in milliseconds, deterministically, offline. Exit code 1 was
already accepted by the assertions.

Before/after under a blackhole proxy simulating the outage:
  OLD: TimeoutExpired after 20s (reproduces the CI failure)
  NEW: completes in 0.2s, exit=1

tests/test_lazy_secrets_dispatch.py

@@ -11,6 +11,7 @@ run the actual commands and verify exit codes — the exact paths the
 reviewer flagged as unproven.
 """
 
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -19,13 +20,40 @@ import pytest
 
 
 def _run_hermes(args: list[str], timeout: int = 30) -> subprocess.CompletedProcess[str]:
-    """Run hermes CLI as a subprocess from repo root."""
+    """Run hermes CLI as a subprocess from repo root.
+
+    The child runs with all git remote URLs rewritten to an unreachable
+    local path (GIT_CONFIG_* env overrides). These tests assert the
+    lazy-crypto / no-self-lock invariants of the dispatch path, NOT update
+    connectivity — but ``hermes update --check`` really does ``git fetch``
+    against github.com when run bare. Under remote throttling that fetch
+    can exceed the subprocess timeout and TimeoutExpired the test (exactly
+    what happened on CI during the 2026-08-17 GitHub incident: both update
+    tests red on main for hours with no code change). Rewriting the URLs
+    makes the fetch fail instantly and deterministically; the update path
+    still exercises its full parser/dispatch/fetch code and exits 1, which
+    the assertions already accept.
+    """
     repo_root = Path(__file__).parent.parent
+    env = dict(os.environ)
+    env.update(
+        {
+            "GIT_CONFIG_COUNT": "2",
+            # Rewrite every https:// and ssh remote to a nonexistent local
+            # path so any fetch fails in milliseconds without touching the
+            # network. insteadOf matching is prefix-based.
+            "GIT_CONFIG_KEY_0": "url.file:///nonexistent-hermes-test-remote/.insteadOf",
+            "GIT_CONFIG_VALUE_0": "https://",
+            "GIT_CONFIG_KEY_1": "url.file:///nonexistent-hermes-test-remote/.insteadOf",
+            "GIT_CONFIG_VALUE_1": "git@",
+        }
+    )
     return subprocess.run(
         [sys.executable, "-m", "hermes_cli.main"] + args,
         capture_output=True,
         text=True,
         cwd=str(repo_root),
+        env=env,
         timeout=timeout,
     )