fix: avoid pinVersion regression from upstream placeholder version

Upstream main declares [project] version 0.0.0 between releases, which made
the nightly pin regress from 0.21.4 to 0.0.0. Fall back to the latest release
tag's version when the HEAD version is the placeholder, and correct the
current candidate's pinVersion to match. Factor the pyproject version lookup
into update-common.sh so both channels share one implementation.

scripts/update-common.sh

@@ -11,6 +11,14 @@ extract_sri_hash() {
   sed -nE 's/.*got:[[:space:]]*(sha256-[A-Za-z0-9+\/=]+).*/\1/p' "$1" | head -1
 }
 
+# Echo the ``[project]`` version from upstream's pyproject.toml at a git ref
+# (branch, tag or commit sha).
+upstream_pyproject_version() {
+  gh api -H "Accept: application/vnd.github.raw+json" \
+    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${1}" |
+    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
+}
+
 realize_flake_source() {
   nix build "$1.src" --no-link --print-out-paths 2>/dev/null | tail -1 || true
 }