fix(profiles): enforce distribution_owned as the actual install/update allowlist

[ygd58]

Context

Fixes #74373.

Problem

_copy_dist_payload() never called manifest.owned_paths() at all -- it iterated every top-level staged entry and copied it unless the name was in USER_OWNED_EXCLUDE or hit a special case. An explicit distribution_owned: [SOUL.md] manifest still installed unrelated entries (unlisted.txt, mcp.json, cron/, etc.) never declared. On update, a staged directory also replaced the destination directory wholesale, silently deleting any target-only children a user had added inside an owned directory.

Fix

1. Resolve owned = set(manifest.owned_paths()) once before the copy loop; skip any top-level staged entry whose name isn't in that set.
2. Directory updates now use shutil.copytree(..., dirs_exist_ok=True) instead of rmtree + fresh copytree -- overwrites/adds staged files but preserves a target-only child, so a user file inside an owned directory survives an update.

Verification

Per the issue's own suggested direction, added regression tests for all 5 named scenarios: listed entry installed, unlisted entry excluded, top-level hard exclusions preserved regardless of manifest, target-only children surviving an update, and config.yaml preservation / --force-config retained. Also fixed 4 pre-existing tests that had encoded the pre-fix behavior as expected, updating them to explicitly opt the relevant directory into distribution_owned while preserving their actual intent (nested name-collision with USER_OWNED_EXCLUDE must not filter).

75/75 tests pass in the full test_profile_distribution.py file; 11/11 in a dependent test file (no regression).

[teknium1]

Thanks for addressing a real current-main defect: _copy_dist_payload() currently ignores DistributionManifest.owned_paths() (hermes_cli/profile_distribution.py:563-590).

Problems

• The new root-name allowlist check at hermes_cli/profile_distribution.py:584 cannot support documented nested entries such as skills/research/ and cron/digest.json (website/docs/user-guide/profile-distributions.md:251-258; website/docs/reference/profile-commands.md:420-433). Those values do not equal root entries skills or cron, so their source content is skipped.
• dirs_exist_ok=True at hermes_cli/profile_distribution.py:596 retains files removed from a later distribution revision. That changes the documented replacement contract (website/docs/user-guide/profile-distributions.md:247,385) and does not distinguish stale distributed files from target-only user files.

Suggested changes

• Copy validated manifest-relative paths and add install/update coverage for nested file and directory allowlist entries.
• Settle and document directory ownership semantics; preserve user files only with a mechanism that still handles distributor removals correctly.

This is an automated hermes-sweeper review.

[teknium1]

This compares a root entry.name with the complete manifest path. The documented distribution_owned syntax permits skills/research/ and cron/digest.json, neither of which matches root entries skills or cron; both payloads would be skipped. Please copy validated relative manifest paths and add nested-path install/update coverage.

[teknium1]

dirs_exist_ok=True also retains files that were distributed in an older revision but removed from the new source. The current docs promise distribution-owned paths are replaced. Please establish an ownership mechanism that preserves genuine user additions without retaining stale distributed files, and document the resulting update contract.

[ygd58]

Both real gaps addressed in #75351:

1. Nested paths: rewrote to resolve each owned_paths() entry directly as a manifest-relative path against staged/target, supporting skills/research/, cron/digest.json, etc. at any depth.
2. Stale vs user files: added installed_files tracking to the manifest; update diffs against the PREVIOUS installations own tracked list and surgically removes only files that were tracked as distributed before and are gone from this revision -- a file never tracked (a genuine user addition inside an owned directory) is never touched.

Three more bugs surfaced while implementing and testing this (all documented in code comments): an upfront rmtree for a whole-directory owned entry would wipe user additions before the diff could run; distribution.yaml is itself a default owned path so the copy loop was clobbering tracking info before it could be read; walking the destination instead of the source to determine what this payload installed incorrectly counted pre-existing stale files; and skipping config.yaml for preserve_config made it look stale and get deleted.

6 new tests plus 2 pre-existing tests updated (they predated any allowlist enforcement and assumed unrestricted copying). 49/49 pass in the full file. Closing this in favor of #75351.