fix(update): review the macOS lock scan's lsof/ps lookups; keep it stdlib-only

The resolution-allowlist ratchet flagged the lsof lookup (moved from
_held_open to _held_open_lsof) and the new ps lookup in _ps_git_holder:
both are the stdlib-only launch-time repair asking the OS's own tools,
with an absent tool meaning "unknown" and the lock kept. Rows renamed
and added with that justification.

_still_running also imported psutil inside the launch-time repair, which
runs from hermes_bootstrap before app dependencies can import; it is now
a POSIX os.kill(pid, 0) probe (the lsof/ps branch never runs on Windows).

hermes_cli/_early_recovery.py

@@ -785,9 +785,14 @@ def _lsof_cwds(lsof: str, pids: list[str]) -> dict[str, str] | None:
 
 
 def _still_running(pid: int) -> bool:
-    import psutil
-
-    return psutil.pid_exists(pid)
+    """POSIX only (the lsof branch never runs on Windows); stdlib, as this launch-time repair must be."""
+    try:
+        os.kill(pid, 0)  # windows-footgun: ok — lsof/ps branch is macOS/BSD only, Windows never reaches it
+    except ProcessLookupError:
+        return False
+    except OSError:  # EPERM: alive, another user's
+        return True
+    return True
 
 
 def _ps_git_holder(lsof: str, git_dir: Path, root: Path, any_git: bool) -> _Holder | bool | None:

tests/fixtures/resolution_allowlist.json

@@ -127,10 +127,16 @@
   },
   {
     "path": "hermes_cli/_early_recovery.py",
-    "symbol": "_held_open",
+    "symbol": "_held_open_lsof",
     "kind": "bare_which",
     "reason": "stdlib-only launch-time repair asks the OS's own lsof (macOS/BSD) whether a dead git's index.lock is still open; absent lsof means unknown and the lock is kept"
   },
+  {
+    "path": "hermes_cli/_early_recovery.py",
+    "symbol": "_ps_git_holder",
+    "kind": "bare_which",
+    "reason": "stdlib-only launch-time repair asks the OS's own ps (macOS/BSD) for lock-keeping gits whose fd is closed; falls back to /bin/ps because the launcher's PATH may hold neither git nor ps; absent ps means unknown and the lock is kept"
+  },
   {
     "path": "hermes_cli/_subprocess_compat.py",
     "symbol": "resolve_node_command",