refactor(skills): dedupe file-listing + share user-modified predicate (follow-up to #48286)

[kshitijk4poor]

Summary

Cleanup follow-up to #48286 (hermes skills list-modified / diff), which merged before these refactors landed. All changes are behavior-preserving — a /simplify-code pass over the salvage diff surfaced four small wins:

Change	Detail
Reuse _skill_file_list()	diff_bundled_skill() reimplemented the rglob → is_file → relative_to().as_posix() file-set enumeration inline (twice — once per side). The module already has _skill_file_list() doing exactly that; now set(_skill_file_list(dest)) / set(_skill_file_list(bundled_src)).
Share the user-modified predicate	Extracted _is_tracked_user_modification(origin_hash, user_hash) and use it in both the sync loop and list_user_modified_bundled_skills() so the "kept user edit" rule (has origin hash AND hash differs) can't drift between the two sites — directly serves AGENTS.md "extend, don't duplicate".
Read binary files once	_read_text_for_diff → _read_for_diff returns (bytes, text); the binary-compare branch now reuses the bytes it already read instead of re-reading both files from disk.
Trim the return contract	Dropped the unused user_present key from diff_bundled_skill()'s return dict (no consumer or test ever read it).
De-brittle the invariant test	test_update_modified_notice dropped its >= 2 sites count-floor (which would fail a welcome consolidation of the two print paths into a shared helper) while keeping the per-site "count notice ⇒ discovery hint" invariant — still mutation-tested.

Verification

• tests/tools/test_skills_sync.py + test_skills_list_modified_diff.py + tests/hermes_cli/test_update_modified_notice.py — 66 passed.
• Mutation-tested the notice invariant: removing the hint from either update path fails the test; restoring it passes.
• The shared predicate keeps the sync loop byte-identical (its empty-origin case is already guarded above the call site, so the predicate's bool(origin_hash) check is redundant-but-harmless there).
• ruff clean.

Follow-up to #48286.