fix(skills): replace symlink install destinations

[Bartok9]

Problem

hermes skills install --force crashes when the existing install destination is a symbolic link because the installer tries to pass that path to shutil.rmtree(), which refuses to operate on symlinks.

Closes #21735

Root cause

install_from_quarantine() only checked install_dir.exists() before cleanup, then always called shutil.rmtree(install_dir). For directory symlinks, that raises OSError instead of replacing the previous install path.

Fix

Add a small cleanup helper that unlinks symlinks and files, while preserving the existing recursive removal behavior for real directories. The regression test installs over a symlinked skill path and verifies the symlink target is left intact.

Testing

• uv run --with ruff --with pytest --with pytest-xdist --python 3.11 ruff check tools/skills_hub.py tests/tools/test_skills_hub.py: clean
• uv run --with pytest --with pytest-xdist --python 3.11 pytest tests/tools/test_skills_hub.py -q: 107 passed

Made with Cursor

[Bartok9]

CI status note:

• The ruff + ty diff failure is the known fork-token comment-posting failure on fork PRs.
• Local ruff is clean for this PR's changed Python files: uv run --with ruff --python 3.11 ruff check tools/skills_hub.py tests/tools/test_skills_hub.py.

This PR does not introduce a lint failure.

[Bartok9]

The test CI failure is pre-existing on main — verified at main SHA 1997b3ba. Not introduced by this PR.

[Bartok9]

The test CI failure is pre-existing on main — verified at main SHA 524cbabd. Not introduced by this PR.

[Bartok9]

CI note: The failing checks (test, e2e, Windows footguns) are pre-existing failures on main at 3c23b15f815e — they fail without this PR's changes. Running pytest locally against main directly reproduces the same 12 failures. None of the failing tests touch the code changed in this PR. This PR is CI-clean with respect to its own scope.

[Bartok9]

Closing to stay under the repo's 10-PR contributor limit. Will resubmit with updated code if the issue is still open in main.