feat(update): make pre-update backup opt-in (off by default) (#16566)

The zip backup could add minutes to every 'hermes update' on large
HERMES_HOME directories. Flip the default to off and add a --backup
flag for one-off opt-in runs.

- updates.pre_update_backup default: True -> False
- hermes update: new --backup flag (opposite of existing --no-backup)
- Silent no-op when disabled (no message spam on every update)
- Existing --no-backup still works and wins over --backup
- Users who explicitly set pre_update_backup: true keep the old behavior
- Tests updated to cover default-off, --backup opt-in, and config-enabled paths

hermes_cli/config.py

@@ -1055,10 +1055,11 @@ DEFAULT_CONFIG = {
     "updates": {
         # Run a full ``hermes backup``-style zip of HERMES_HOME before every
         # ``hermes update``.  Backups land in ``<HERMES_HOME>/backups/`` and
-        # can be restored with ``hermes import <path>``.  Set to false to
-        # skip the backup entirely; use the ``--no-backup`` flag on a single
-        # update invocation to override just that run.
-        "pre_update_backup": True,
+        # can be restored with ``hermes import <path>``.  Off by default —
+        # on large HERMES_HOME directories the zip can add minutes to every
+        # update.  Set to true to re-enable, or pass ``--backup`` to opt in
+        # for a single update run.
+        "pre_update_backup": False,
         # How many pre-update backup zips to retain.  Older ones are pruned
         # automatically after each successful backup.
         "backup_keep": 5,

hermes_cli/main.py

@@ -6145,16 +6145,21 @@ def _ensure_fhs_path_guard() -> None:
 def _run_pre_update_backup(args) -> None:
     """Create a full zip backup of HERMES_HOME before running the update.
 
-    Gated on ``updates.pre_update_backup`` in config (default true).  The
-    ``--no-backup`` flag on ``hermes update`` overrides it for one run.
-    Never raises — a backup failure should not block the update itself.
+    Gated on ``updates.pre_update_backup`` in config (default false).  Off
+    by default because the zip can add minutes to every update on large
+    HERMES_HOME directories.  The ``--backup`` flag on ``hermes update``
+    opts in for a single run; ``--no-backup`` forces it off when config
+    has it enabled.  Never raises — a backup failure should not block the
+    update itself.
     """
-    # CLI flag wins over config
+    # CLI flags win over config.  --no-backup beats --backup if both are set.
     if getattr(args, "no_backup", False):
         print("◆ Pre-update backup: skipped (--no-backup)")
         print()
         return
 
+    force_backup = bool(getattr(args, "backup", False))
+
     try:
         from hermes_cli.config import load_config
         cfg = load_config()
@@ -6163,12 +6168,13 @@ def _run_pre_update_backup(args) -> None:
         cfg = {}
 
     updates_cfg = cfg.get("updates", {}) if isinstance(cfg, dict) else {}
-    enabled = updates_cfg.get("pre_update_backup", True)
+    enabled = updates_cfg.get("pre_update_backup", False)
     keep = updates_cfg.get("backup_keep", 5)
 
-    if not enabled:
-        print("◆ Pre-update backup: disabled (updates.pre_update_backup=false in config.yaml)")
-        print()
+    if not enabled and not force_backup:
+        # Silent by default — the backup is off, most users don't need to
+        # hear about it on every update.  They can opt in via --backup
+        # or by flipping the config knob.
         return
 
     try:
@@ -6221,8 +6227,8 @@ def _run_pre_update_backup(args) -> None:
 
     print(f"  Saved:    {display_path} ({size_str}, {elapsed:.1f}s)")
     print(f"  Restore:  hermes import {out_path}")
-    print(f"  Disable:  set updates.pre_update_backup: false in config.yaml")
-    print(f"            (or pass --no-backup on a single update)")
+    print(f"  Disable:  omit --backup (backups are off by default)")
+    print(f"            set updates.pre_update_backup: false in config.yaml")
     print()
 
 
@@ -9671,6 +9677,12 @@ Examples:
         default=False,
         help="Skip the pre-update backup for this run (overrides updates.pre_update_backup)",
     )
+    update_parser.add_argument(
+        "--backup",
+        action="store_true",
+        default=False,
+        help="Force a pre-update backup for this run (off by default; overrides updates.pre_update_backup)",
+    )
     update_parser.set_defaults(func=cmd_update)
 
     # =========================================================================