fix(update): avoid blocking install during self-update

[qdivan]

Summary

Fixes #1505.

The self-update endpoint no longer runs the global npm install -g hermes-web-ui@latest through execFileSync. The update install and follow-up npm root -g lookup now use the existing async execFile wrapper, so the Node event loop can continue serving requests while npm is pending. The in-process update lock is also released through a finally path when installation fails, while successful installs keep the lock until restart handling begins.

Validation

• Failing-before-fix regression recorded: npm exec vitest -- run tests/server/update-controller.test.ts failed because the pending async install callback was absent and the controller still used execFileSync.
• PATH=/Users/shangyifan/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH npm exec vitest -- run tests/server/update-controller.test.ts
• git diff --check
• PATH=/Users/shangyifan/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH npm run harness:check
• PATH=/Users/shangyifan/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH npm run test:coverage
• PATH=/Users/shangyifan/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH npm run build

Build completed with the existing Vite large chunk warning only.

Duplicate Check

• Open PR fix: add cwd option to npm execFileSync to prevent uv_cwd error under systemd #1043 touches update.ts, but only adds a cwd for the existing execFileSync path to address a separate uv_cwd systemd failure. It does not replace the synchronous update install.
• Open PR fix: handle agent-bridge worker restart gracefully (no more 'unknown run' UI errors) #989 is agent-bridge restart recovery and does not touch the update install path.
• Batch open-PR inventory and read-only candidate/patch review found no active PR replacing the synchronous update install path.

Browser / Playwright

Not run locally. This is server-controller behavior for /api/hermes/update; no visible UI, browser routing, or interaction changed.