test(install): verify installer progress survives the CLI extraction

Exercise a real child writing beyond pipe capacity on success and failure. Both tests fail on upstream/main and pass with the merged stdout routing. Annotate the matrix rank input for TypeScript 6 checkJs.

scripts/sandbox/generate-e2e-matrix.mjs

@@ -320,6 +320,7 @@ export function renderMarkdownResults(jobs, tagAnnotations = [], artifactById =
   // Rendered success/failure cells carry artifact links after the glyph;
   // rank by the leading token or every such cell would rank as unknown (-1)
   // and lose to any skip already in the map.
+  /** @param {string} cell */
   const rankOf = (cell) => RANK.findIndex((t) => cell === t || cell.startsWith(`${t} `));
   /** @type {Map<string, Map<string, string>>} */
   const rows = new Map();

tests/hermes_cli/test_install_progress_stream.py

@@ -0,0 +1,32 @@
+"""Installer progress must use the stream drained by the desktop updater."""
+
+import subprocess
+import sys
+
+import pytest
+
+from hermes_cli.main_install_repair import _run_install_with_heartbeat
+
+
+@pytest.mark.parametrize("exit_code", [0, 7])
+def test_installer_stderr_streams_to_stdout(tmp_path, monkeypatch, capfd, exit_code):
+    import hermes_cli.main as main
+
+    monkeypatch.setattr(main, "PROJECT_ROOT", tmp_path)
+    # More than a pipe buffer of progress, from a real child on the native host.
+    size = 256 * 1024
+    cmd = [
+        sys.executable,
+        "-c",
+        f"import sys; sys.stderr.write('x' * {size}); sys.stderr.flush(); sys.exit({exit_code})",
+    ]
+    if exit_code:
+        with pytest.raises(subprocess.CalledProcessError) as error:
+            _run_install_with_heartbeat(cmd)
+        assert error.value.returncode == exit_code
+    else:
+        _run_install_with_heartbeat(cmd)
+
+    output = capfd.readouterr()
+    assert output.out == "x" * size
+    assert output.err == ""