Pairs with install_github_app_pem.py: that commit drops the GitHub App
PEM at boot so Hermes can mint installation tokens for outbound git/API
auth.  This commit closes the loop by registering the tap entries that
use those tokens, so the AmbulnzLLC pilot's shared-skills repo (and any
private skill repos in similar deployments) appears in 'hermes skills
browse / search / inspect / install' without operators having to run
'hermes skills tap add' after every deploy.

Behavior:
- HERMES_DEFAULT_TAPS unset/empty -> silent no-op (generic deploys)
- Set -> each entry is normalized and appended to taps.json if missing.
  Format is comma- or newline-separated 'owner/repo[@path]' or full URL.
- Idempotent: re-running on the same env doesn't duplicate entries and
  doesn't rewrite an already-correct file.
- Preserves user-added taps; only appends, never deletes.  This is a
  SEED, not a lock — operators can 'hermes skills tap remove' afterwards
  and the entry is re-seeded on the next boot.
- Refuses to clobber a malformed taps.json (non-zero exit), so a
  hand-edited file with a typo crash-loops rather than silently losing
  the user's customizations.
- Refuses URLs with embedded credentials (user:token@host) — those
  belong in the App PEM, not in taps.json on the data volume.
- Atomic write (tmp + rename) so a crash mid-write leaves the previous
  taps.json intact.

Wired into entrypoint.sh after the gosu drop so the resulting
taps.json is owned by the hermes user from the start (it lives at
$HERMES_HOME/skills/.hub/taps.json which the hermes user already owns).

Tests cover: parsing of all entry forms, separator handling, invalid
entries, auth-URL rejection, no-op-on-empty, idempotence, dedup against
trailing-slash variants, preservation of user-added taps, malformed-file
crash, wrong-shape-file crash, multi-entry seeding, and atomic-write
cleanup.

Pairs with seed_taps.py: that registers private skill repos as taps;
this commit closes the loop by installing specific skills from those
taps (or any other source 'hermes skills install' accepts — well-known
indexes, direct SKILL.md URLs, etc.) so the AmbulnzLLC pilot's required
skills are present on every pod immediately after boot, instead of the
operator having to run 'hermes skills install' for each one post-deploy.

Behavior:
- HERMES_DEFAULT_SKILLS unset/empty -> silent no-op (generic deploys)
- Set -> each entry is fed to hermes_cli.skills_hub.do_install with
  skip_confirm=True (boot is non-interactive) and force=False.  The
  admin-baked path explicitly does NOT bypass scan verdicts; that's a
  manual decision.
- Format: comma- or newline-separated identifiers (e.g.
  'AmbulnzLLC/hermes-shared-skills/skills/data-engineering/airflow-dag')
  with optional '@<name>' suffix for URL-sourced skills whose SKILL.md
  has no 'name:' frontmatter field.
- Idempotent: skills already in lock.json (matched by recorded
  identifier, trailing-slash insensitive) are skipped without invoking
  the installer.
- Non-fatal: a single failed install (network blip, scan blocked,
  malformed SKILL.md, do_install calling sys.exit) emits a warning and
  the script exits 0 so boot continues.  A bad private-skill repo must
  not crash-loop the pod and take chat down with it.
- Refuses URLs with embedded credentials — those belong in the App PEM,
  not in HERMES_DEFAULT_SKILLS (visible in process tables and pod logs).
- Malformed lock.json is warned about, not fatal — installs will still
  attempt and surface their own errors.

Wired into entrypoint.sh after seed_taps.py so any tap-relative
identifiers resolve.  Runs as the hermes user (post-gosu) so installed
skill files end up with correct ownership without an extra chown.

This is a SEED, not a lock.  After boot the hermes user can
'hermes skills uninstall <name>' for ad-hoc debugging — but on the next
container boot the skill will be re-installed.  Admin desired-state
wins across reboots.

Tests cover: parsing of bare/URL forms, '@<name>' suffix, separator
handling, invalid entries, auth-URL rejection, no-op-on-empty,
idempotence via lockfile match, trailing-slash dedup, partial-failure
continuation, SystemExit catch, missing lockfile, and malformed-lockfile
non-fatal handling.  17 tests, all passing.

Admin-curated entries in HERMES_DEFAULT_SKILLS are reviewed out-of-band
before being added to the seed list, so the scanner's per-pod caution
verdicts shouldn't block them at boot. Without this, any default skill
that trips scan heuristics (e.g. ambulnz-github-app-auth, which the
scanner flags for env-var reads and a redacted git URL example) is
silently dropped on every fresh pod, requiring an operator to manually
re-run `hermes skills install --force` for each one.

The forbid-force comment in the module docstring is replaced with the
new contract, including the escape hatch (drop the entry from
HERMES_DEFAULT_SKILLS if you want scan verdicts respected for it).