feat(skills): find & diff user-modified bundled skills

[xxxigm]

Summary

Reported on Discord (Hana): hermes update says certain skills were "modified by the user" and won't be updated, but there's no way to see which skills, diff them, or know they're recoverable. They end up stuck stale even though the edits were inadvertent.

Verified against main:

• Reverting already exists — hermes skills reset <name> (re-baseline, keep your copy) and hermes skills reset <name> --restore (replace with stock). ✅
• Listing the flagged skills is a real gap — hermes update only prints ~ N user-modified (kept), no names. ❌
• Diffing against the stock version is a real gap. ❌

This PR closes the two gaps, reusing the manifest origin-hash that the sync engine already maintains (~/.hermes/skills/.bundled_manifest). No new model tools — pure CLI surface (Footprint Ladder rung 1–2).

Changes (commit 1)

• tools/skills_sync.py:
  • list_user_modified_bundled_skills() — returns the bundled skills whose on-disk copy diverges from the last-synced origin hash (the exact test the sync loop uses to decide what to skip).
  • diff_bundled_skill(name) — unified diff of the user copy vs the current bundled (stock) copy, per file (modified / added / removed / binary).
• hermes skills list-modified [--json] and hermes skills diff <name> (parser + router + handlers), mirrored as /skills list-modified and /skills diff.
• hermes update's "user-modified" notice now points at hermes skills list-modified.

$ hermes update
  ...
  ~ 2 user-modified (kept)
    → see them: hermes skills list-modified  (diff/reset to resume updates)

$ hermes skills list-modified
  2 user-modified bundled skill(s) (kept as-is by `hermes update`):
    ~ google-workspace
    ~ research
  See changes:    hermes skills diff <name>
  Resume updates: hermes skills reset <name>            (keep your copy, re-baseline)
  Revert to stock: hermes skills reset <name> --restore

Test plan (commit 2)

• scripts/run_tests.sh tests/tools/test_skills_list_modified_diff.py — 6 passed. Exercises the real sync pipeline (no mocked comparison): pristine → not flagged; edited → listed + diffed (modified & added files); unknown skill → not-ok; reset --restore clears the modified state so revert and discovery agree.
• scripts/run_tests.sh tests/hermes_cli/test_skills_hub.py tests/hermes_cli/test_argparse_flag_propagation.py — 45 passed (no parser/routing regressions).

[alt-glitch]

Related: #28213 (Skill Lifecycle Transparency: hermes skills status + diff), #18402 (hermes update should show what changed / offer to reset user-modified skills), #29856 (misleading hermes skills reset success message). This PR implements the list-modified + diff surface those issues ask for, reusing the existing .bundled_manifest origin-hash.

[kshitijk4poor]

Thanks for this @xxxigm — clean implementation and the detection logic correctly mirrors the sync engine's user-modified test (frontmatter-name + full category path, not dirname), which matters for the 36/240 bundled skills whose frontmatter name differs from their directory and the 36 that nest in deeper categories.

I've salvaged your commits into #48286 (your authorship is preserved via cherry-pick). The salvage adds two small fixes found during review:

• Sibling notice — the ~ N user-modified (kept) hint was added to the git-pull update path but the byte-identical notice in the unpack/install path was missed; mirrored it to both (plus an invariant test guarding the drift).
• diff verb — hermes skills diff <name> now shares the verb with the gateway write-approval diff <id>; updated the gateway handler's docstring + chat-truncation message (which pointed at /skills diff <id> on the CLI) to avoid the collision.

Closing in favor of #48286. Thanks again!