fix(auth): make provider config writes atomic

[teknium1]

Salvage of #16504 onto current main (cherry-picked clean, authorship preserved via rebase-merge).

Summary

Switches the two remaining raw-YAML config.yaml writes in hermes_cli/auth.py to the established atomic_yaml_write helper. An interrupted provider-switch or logout can no longer leave config.yaml partially written.

Changes

• hermes_cli/auth.py: _update_config_for_provider and _reset_config_provider now call atomic_yaml_write (2 lines).
• Added regression tests for both paths that raise OSError mid-write and assert the original config bytes survive.

Validation

• Targeted tests (both new): 2 passed.
• E2E: ran both real functions on a temp HERMES_HOME — correct config written, no tempfile leaks on success.
• Repo-wide sibling audit: no other un-atomic write_text(yaml.safe_dump(...)) sites remain outside of tests.

Credit: @Yukipukii1 (commit authorship preserved).
Closes #16504.