Follow-up on the #83854 salvage: prepend $HERMES_HOME/bin ahead of the venv and user-local bin dirs, matching the managed-first Browser Use CLI resolution policy — the worker resolves the same canonical binary the agent process does.