fix: address review — reuse sudo var, add chown -h on symlink update

- hermes_cli/main.py: reuse the existing `sudo` variable instead of
  redundant `shutil.which("sudo")` call that could return None
- nix/nixosModules.nix: add missing `chown -h` when updating an
  existing symlink target so ownership stays consistent with the
  fresh-create and backup-replace branches

hermes_cli/main.py

@@ -612,7 +612,7 @@ def _exec_in_container(container_info: dict, cli_args: list):
         if val:
             env_flags.extend(["-e", f"{var}={val}"])
 
-    cmd_prefix = [shutil.which("sudo"), "-n", runtime] if needs_sudo else [runtime]
+    cmd_prefix = [sudo, "-n", runtime] if needs_sudo else [runtime]
     exec_cmd = (
         cmd_prefix + ["exec"]
         + tty_flags

nix/nixosModules.nix

@@ -684,6 +684,7 @@ HERMES_CONTAINER_MODE_EOF
                   current_target=$(readlink "${symlinkPath}")
                   if [ "$current_target" != "${target}" ]; then
                     ln -sfn "${target}" "${symlinkPath}"
+                    chown -h ${user}:${cfg.group} "${symlinkPath}"
                   fi
                 elif [ -d "${symlinkPath}" ]; then
                   # Existing real directory — backup and replace