opentui(phase3): launcher integration — HERMES_TUI_ENGINE dual-engine

hermes --tui launches the native OpenTUI engine (Bun) when
HERMES_TUI_ENGINE=opentui (env) or display.tui_engine=opentui (config);
Ink stays the default and the shipping path is untouched.

- _resolve_tui_engine() (env > config > ink); refuses opentui on
  Windows/Termux (no Bun) -> falls back to ink with a notice.
- _make_opentui_argv() -> [bun, src/entry.real.tsx] (no build step).
- _bun_bin() with HERMES_BUN override.
- Branch at top of _make_tui_argv BEFORE _ensure_tui_node (Bun-only host
  must not bootstrap Node).
- Gate _launch_tui NODE_OPTIONS/--max-old-space-size on engine==ink (Bun
  is JSC; the V8 flag errors/ignores).

Verified end-to-end via tmux: real hermes --tui -> Bun -> OpenTUI ->
real Python gateway streamed a real reply. No-flag default still ink.

tests/tools/test_windows_native_support.py

@@ -841,15 +841,13 @@ class TestLocalEnvironmentWindowsTempDir:
 
 
 class TestLocalEnvironmentPathInjectionGated:
-    """Sane PATH completion must stay POSIX-only."""
+    """The /usr/bin PATH injection in _make_run_env must be POSIX-only."""
 
-    def test_windows_path_is_left_unchanged(self, monkeypatch):
-        from tools.environments import local as local_mod
-        from tools.environments.local import _append_missing_sane_path_entries
-
-        monkeypatch.setattr(local_mod, "_IS_WINDOWS", True)
-        path = r"C:\Windows\System32;C:\Program Files\Git\bin"
-        assert _append_missing_sane_path_entries(path) == path
+    def test_source_gates_path_injection(self):
+        root = Path(__file__).resolve().parents[2]
+        source = (root / "tools" / "environments" / "local.py").read_text(encoding="utf-8")
+        # The fix wraps the injection in `if not _IS_WINDOWS`.
+        assert 'not _IS_WINDOWS and "/usr/bin" not in existing_path.split(":")' in source
 
 
 # ---------------------------------------------------------------------------