fix(tools): quote Daytona sync paths before remote mkdir

[Dusk1e]

While exploring the Daytona environment integration, I found myself tracing the initial synchronization process that Hermes performs to mirror local skills and credentials into the sandbox. Everything appeared standard on the surface, but as I dug deeper into the _upload_if_changed method, something caught my eye.

I noticed that before any file is uploaded, the system has to ensure the remote parent directory exists. It does this by building a quick mkdir -p shell command. However, the path was being dropped directly into the command string without any defensive quoting.

This led me to wonder: what if a skill file wasn't named as expected? Upon closer inspection, I realized that an attacker who could control a skill's filename—perhaps by submitting a malicious repository—could inject shell metacharacters. The plot thickened when I realized that Hermes syncs credentials into the same sandbox. An injected ; or & in a filename could allow a command to run and exfiltrate those very secrets before the backend even finished initializing.

To secure this boundary, I’ve introduced proper shell quoting using shlex.quote() and added the POSIX -- flag to the mkdir call. This ensures that every directory path is treated strictly as data, no matter how "evil" its name might be.

I've included a regression test that mimics a malicious skill path to prove the fix works. The test demonstrates that a path containing a command injection payload is now safely neutralized and treated as a literal string by the Daytona backend.