fix(hermes): use native Windows trusted recipe

[CompleteDotTech]

Summary

• make the trusted Hermes recipe platform-aware: Windows launches native hermes with -q prompt flags, while macOS/Linux retain the POSIX hermes-coven shim
• recognize the exact legacy Hermes manifest and upgrade it in-memory to the current platform recipe
• synchronize the trusted POSIX and Windows documents with the manifests rendered by Cave PR #3704

Validation

• cargo fmt --check
• rendered Cave POSIX/Windows manifests exactly match the embedded trusted recipes
• Rust test execution is blocked in this WSL image because its only C compiler cannot load libisl.so.23 while building blake3

Depends on OpenCoven/coven-cave#3704 for its Windows manifest migration.