Summary

Fixes #14181.

This preserves file permissions when Hermes rewrites skill runtime files through atomic temp-file replacement.

Root cause

tempfile.mkstemp() creates replacement files as 0600. Both skill_manage writes and bundled skill manifest writes then used os.replace() directly, so existing group-readable/group-writable files could be silently recreated as owner-private files in managed/shared deployments.

Fix

• Preserve the existing target file mode before replacing SKILL.md or .bundled_manifest.
• For new files, apply the process umask-derived default file mode instead of leaving the mkstemp() default.
• Add regressions for skill_manage atomic writes and skills_sync manifest writes preserving 0660 files.

Validation

• /Users/stephenyu/Documents/hermes-agent/.venv/bin/python -m pytest tests/tools/test_skill_manager_tool.py::TestAtomicWriteText::test_preserves_existing_file_mode tests/tools/test_skills_sync.py::TestReadWriteManifest::test_write_manifest_preserves_existing_file_mode -q --tb=short
• /Users/stephenyu/Documents/hermes-agent/.venv/bin/python -m pytest tests/tools/test_skill_manager_tool.py tests/tools/test_skills_sync.py -q --tb=short
• git diff --check