Fix hidden directory filter broken on Windows

[ch3ronsa]

Fixes #389

Summary

• _find_all_skills() in tools/skills_tool.py and scan_skill_commands() in agent/skill_commands.py used hardcoded forward-slash strings ('/.git/', '/.hub/') to filter hidden directories
• On Windows, str(Path(...)) returns backslash-separated paths, so the filter never matched
• This exposed quarantined skills (downloaded but not yet approved by security scanner) as installed and invocable on Windows

Fix

Replaced string-based path check with Path.parts membership test, which is platform-independent:

# Before (broken on Windows):
if '/.git/' in path_str or '/.github/' in path_str or '/.hub/' in path_str:

# After (works on all platforms):
if any(part in ('.git', '.github', '.hub') for part in skill_md.parts):

Test plan

• Verified with simulated Windows paths (C:\Users\me\.hermes\skills\.hub\quarantine\...) — correctly blocked
• Verified with simulated Linux paths (/home/me/.hermes/skills/.hub/...) — correctly blocked
• Legitimate skills not affected on either platform

[ch3ronsa]

Didn't notice #390 already covers this with the same Path.parts fix and a full test suite. Closing as duplicate.