Bug Report: hermes profile install/update destructively replaces local profile skills despite distribution_owned flag

Description

Native hermes profile install and hermes profile update commands are unsafe for live profiles because the distribution_owned flag in the distribution manifest is ignored. The code path in profile_distribution.py (approximately lines 554–556) deletes existing local skill directories before copying distribution files, causing destructive replacement of live profile content regardless of whether the profile has locally-authored skills that should be preserved.

Observed Behavior

When running hermes profile install or hermes profile update on a live profile that has local skills not part of the distribution:

1. The tool deletes the target profile's skills/ directory
2. Copies distribution skills in
3. Any locally-installed/developed skills are lost

The distribution_owned flag (which should protect locally-owned assets from deletion) is present in the manifest schema but not enforced during the install/update operation.

Root Cause

profile_distribution.py performs a destructive sync rather than an additive merge. It treats the distribution as authoritative and the local state as replaceable, which is incorrect for live profiles that accumulate locally-authored skills (e.g., custom skills in skills/devops/, skills/review/, etc.).

Impact

• Data loss — locally installed skills destroyed on every profile update
• Broken workflow — users who maintain per-profile custom skills cannot safely use native install/update
• Workaround required — all convergence must use manual cp with backup, not the native tooling

Reproduction

1. Install a custom skill locally: ~/.hermes/profiles/worker/skills/devops/my-custom-skill/SKILL.md
2. Run hermes profile update worker
3. Observe: my-custom-skill/ is deleted, replaced only with distribution-bundled skills

Suggested Fix

Option A — Honor distribution_owned: Do not delete or overwrite skills that are marked as distribution_owned: false or skills that do not exist in the distribution manifest.

Option B — Additive merge: Change the install/update to add/update only distribution-managed files, leaving all other files intact. Delete only files whose distribution manifest explicitly marks them for removal.

Option C — Safe mode: Add a --safe or --additive flag that prevents any deletion, only adding missing files.