fix(cli): preserve explicit dashboard update checks

Opt the two passive consumers into the config gate; retain default explicit checks and the existing dashboard caller contract.

hermes_cli/_startup_fast.py

@@ -167,7 +167,7 @@ def print_fast_version_info(*, check_updates: bool = True) -> None:
         from hermes_cli.banner import UPDATE_AVAILABLE_NO_COUNT, check_for_updates
         from hermes_cli.config import recommended_update_command
 
-        behind = check_for_updates()
+        behind = check_for_updates(passive=True)
         if behind == UPDATE_AVAILABLE_NO_COUNT:
             print(f"Update available — run '{recommended_update_command()}'")
         elif behind and behind > 0:

hermes_cli/banner.py

@@ -321,7 +321,7 @@ def _read_json(path: Path) -> Optional[dict]:
     return blob if isinstance(blob, dict) else None
 
 
-def check_for_updates() -> Optional[int]:
+def check_for_updates(*, passive: bool = False) -> Optional[int]:
     """Check whether a Hermes update is available.
 
     If ``HERMES_REVISION`` is set (nix builds embed it), compare it to upstream main via
@@ -331,7 +331,7 @@ def check_for_updates() -> Optional[int]:
         from hermes_cli.config import load_config
         return load_config().get("updates", {}).get("check", True) is False
 
-    if _quiet(_read_config_opt_out) is True:
+    if passive and _quiet(_read_config_opt_out) is True:
         return None
 
     cache_file = get_hermes_home() / ".update_check"
@@ -452,7 +452,7 @@ def prefetch_update_check():
     """Kick off update check in a background daemon thread."""
     def _run():
         global _update_result
-        _update_result = check_for_updates()
+        _update_result = check_for_updates(passive=True)
         _update_check_done.set()
     _daemon(None, _run)
 

tests/hermes_cli/test_passive_update_opt_out.py

@@ -16,9 +16,10 @@ def test_passive_check_obeys_config_before_using_cached_notice(monkeypatch):
     monkeypatch.delenv("HERMES_REVISION", raising=False)
     config = home / "config.yaml"
     config.write_text("updates:\n  check: true\n", encoding="utf-8")
-    assert banner.check_for_updates() == 17
+    assert banner.check_for_updates(passive=True) == 17
     config.write_text("updates:\n  check: false\n", encoding="utf-8")
-    assert banner.check_for_updates() is None
+    assert banner.check_for_updates(passive=True) is None
+    assert banner.check_for_updates() == 17
 
 
 def test_explicit_check_fetches_local_origin_despite_passive_opt_out(tmp_path, monkeypatch, capsys):