fix(constants): ignore host container runtime mounts

[BROCCOLO1D]

Summary

• Restricts the /proc/self/mountinfo container-runtime fallback to the root mount only, so host-side Docker/containerd mounts no longer make a normal host look containerized.
• Closes Dashboard update controls hidden on systemd host with Docker/containerd running #48594.

Why

• Dashboard update controls hidden on systemd host with Docker/containerd running #48594 reports dashboard update controls disappearing on systemd hosts that run Docker/containerd.
• The current is_container() fallback scans all of mountinfo for containerd/crio/kubepods, which also matches host runtime storage mounts under /var/lib/containerd even when Hermes is not running inside a container.

Changes

• hermes_constants.py: keep existing explicit Docker/Podman/Kubernetes/cgroup checks, but only trust the cgroup-v2 mountinfo fallback when the runtime marker appears on the actual / mount.
• tests/test_hermes_constants.py: add a regression case for a host root mount plus a separate /var/lib/containerd/... mount.

Validation

• python -m pytest tests/test_hermes_constants.py -o 'addopts=' -q (47 passed)
• python -m py_compile hermes_constants.py
• git diff --check

Scope

• In scope: preventing host container-runtime mounts from tripping is_container() while preserving root-mount cgroup-v2 container detection.
• Out of scope: changing dashboard update-control logic or unrelated service-manager/container detection paths.