fix(auth): make provider config writes atomic

[Yukipukii1]

Summary

This fixes two non-atomic config.yaml writes in the auth provider flow.

Previously, Hermes wrote config.yaml directly in:

• _update_config_for_provider()
• _reset_config_provider()

That meant an interrupted write during provider switch or logout could leave
config.yaml partially written or corrupted.

This patch switches both paths to atomic_yaml_write(...), aligning them with
the repo’s existing config persistence hardening.

Changes

• use atomic_yaml_write in hermes_cli/auth.py for provider update writes
• use atomic_yaml_write in hermes_cli/auth.py for provider reset/logout writes
• add regression tests covering both paths

Why this matters

Provider selection and logout are user-facing config mutation paths. If either
write is interrupted, Hermes can end up with a broken config.yaml, which is a
bad failure mode for a small persistence path that already has an atomic helper.

Testing

Ran:

scripts/run_tests.sh \
  tests/hermes_cli/test_model_provider_persistence.py::TestProviderPersistsAfterModelSave::test_update_config_for_provider_uses_atomic_yaml_write \
  tests/hermes_cli/test_auth_commands.py::test_reset_config_provider_uses_atomic_yaml_write

2 passed