fix(environments): profile-aware snapshot store paths + owner-only perms on writes

[isheng-eqi]

Summary

Two related fixes for snapshot store handling in terminal environments:

1. Profile-scoped snapshot store paths (modal.py, singularity.py): Module-level _SNAPSHOT_STORE captured get_hermes_home() at import time, which is stale in long-lived multi-profile runtimes (Dashboard/TUI/cron). Replace with _snapshot_store_path() resolved at call time, matching the pattern from [Bug]: Profile-local skills are unavailable in Dashboard/TUI/Desktop GUI because child processes use the root HERMES_HOME #40677.

2. Owner-only permissions on snapshot writes (base.py): _save_json_store() wrote snapshot files with the process default umask. Wrap the write with umask(0o077) to restrict metadata files that may contain env-carried secrets. Also remove the redundant runtime umask 077 commands from the bootstrap and exec paths, now that the store-level write handles it.

Changes

• tools/environments/modal.py: _SNAPSHOT_STORE → _snapshot_store_path() call-time resolution
• tools/environments/singularity.py: _SNAPSHOT_STORE → _snapshot_store_path() call-time resolution
• tools/environments/base.py: _save_json_store() wraps write with umask(0o077); removes duplicate umask 077 from bootstrap/exec

Why this is correct and safe

• Profile-scope fix follows the established pattern from [Bug]: Profile-local skills are unavailable in Dashboard/TUI/Desktop GUI because child processes use the root HERMES_HOME #40677, fix(skills): profile-aware skills resolution in long-lived runtimes (#40677) #60180, fix(auxiliary): resolve auth.json path at call time for multi-profile runtimes #60241
• The umask wrapping in _save_json_store is the canonical single point — the two umask 077 in bootstrap/exec were redundant and inconsistently applied
• No behavior change for single-profile CLI sessions

[alt-glitch]

This was generated by AI during triage.

Duplicate of #60259 — same-author clean isolation of that stacked-branch PR's environments-only contribution: byte-identical os.umask(0o077) guard on _save_json_store() plus the import-time _SNAPSHOT_STORE → call-time _snapshot_store_path() resolver in tools/environments/{base,modal,singularity}.py. #60259 (created earlier) additionally carries 6 unrelated stacked-branch files; this PR is the focused 3-file version. Related: #60180 (stack base), #60199 (merged owner-only umask fix at the shell export -p snapshot site, a different write path). A human should pick whether to take this clean isolation or the fuller #60259.

[isheng-eqi]

Closing — #60259 (the referenced duplicate) was intentionally closed by me to create this clean replacement. Will re-submit to avoid bot false-positive.