feat(skills): find & diff user-modified bundled skills (salvage of #47802)

[kshitijk4poor]

Summary

Salvage of #47802 by @xxxigm (credit preserved via cherry-pick). Closes the two gaps reported on Discord (Hana): hermes update says certain bundled skills were "modified by the user" and won't be updated, but there was no way to see which skills or diff them.

Verified against main:

• Reverting already exists — hermes skills reset <name> (re-baseline) and --restore (replace with stock). ✅
• Listing the flagged skills — real gap. ❌ → now hermes skills list-modified
• Diffing against stock — real gap. ❌ → now hermes skills diff <name>

Pure CLI surface (no model tools, no per-call schema growth). Detection reuses the manifest origin-hash the sync engine already maintains.

Why salvage (and why this over the duplicate #17156)

There's an older PR (#17156) that adds only hermes skills diff, matching the bundled skill by directory name and scanning one category level deep. That breaks for a large fraction of the catalog:

• 36 of 240 bundled skills have frontmatter-name ≠ dirname (e.g. dir mlops/vllm → name serving-llms-vllm).
• 36 skills nest >1 category level deep (e.g. mlops/vector-databases/qdrant).

This PR resolves skills via _discover_bundled_skills (frontmatter name) + _compute_relative_dest (full category path) — exactly how the sync engine addresses skills — so it's correct for all 240, and it adds list-modified (the primary reported gap) which #17156 lacks. #17156 is also stale (conflicting, unreviewed). This PR supersedes it.

What the salvage adds on top of @xxxigm's work

Fix	Detail
W1 — sibling notice	The original patched the ~ N user-modified (kept) notice in the git-pull update path (_cmd_update_impl) to point at hermes skills list-modified, but the byte-identical notice in the unpack/install update path (main.py) was missed. Users hitting that path never learned the command exists. Mirrored the hint to both sites.
W2 — diff verb disambiguation	hermes skills diff <name> (bundled-vs-stock) now shares the verb with the gateway write-approval diff <id>. The gateway handler's docstring + chat-truncation message pointed users to /skills diff <id> "on the CLI" — which now resolves a bundled skill by that name instead. Repointed to the pending JSON file and documented that the two diff commands are distinct.
Test	Added test_update_modified_notice.py: an invariant test asserting every user-modified (kept) notice in main.py carries the discovery hint (guards the sibling-drift bug class). Mutation-tested — fails when either site loses the hint.

Detection logic (faithful mirror of the sync loop)

list_user_modified_bundled_skills() uses the exact test the sync loop (tools/skills_sync.py) uses to decide what to skip:

origin_hash = manifest.get(name)
if not origin_hash: continue          # un-baselined / v1 → not a tracked modification
if _dir_hash(dest) != origin_hash:    # user edited → flag

Test plan

• tests/tools/test_skills_list_modified_diff.py — 6 passed (real sync pipeline, no mocked comparison).
• tests/hermes_cli/test_update_modified_notice.py — invariant guard for both update paths (mutation-tested).
• tests/hermes_cli/test_skills_hub.py + test_argparse_flag_propagation.py — 45 passed (no parser/routing regressions).
• Programmatic E2E against a temp HERMES_HOME: pristine → not flagged; edited → listed + diffed; unknown skill → not-ok; reset --restore clears modified state.

---

Based on #47802 by @xxxigm. Supersedes #17156 by @shashwatgokhe.