fix(skills): add opt-in external read-only boundary

[morelandreas]

Summary

This is a current-main rebase and salvage of #65270, preserving the two original commits and authorship from @insecurejezza. It supersedes the narrower approach in #51412: that PR guards configured skill directories, but not all resolved mutation targets or a symlinked active skills root.

Reproduction

On current main (40643cbaf9b767af146694131ffb8f8160f25e1c), a temporary HERMES_HOME configured with both skills.external_dirs and skills.external_read_only: true still allowed skill_manage(action="patch") to mutate an external SKILL.md. The regression assertion expected refusal and failed because the call returned success: true.

Behavior contract

• Default remains writable (skills.external_read_only: false), preserving intentional foreground edits of external skills.
• With the opt-in enabled, skill_manage fails closed for create, edit, patch, delete, write_file, and remove_file when the skill or resolved mutation target escapes the active profile skills root.
• Handles configured external roots, nested roots, local symlink escapes, and a symlinked active skills root. remove_file can still unlink a final local symlink without touching its target.
• skills_list, skill_view, slash-command discovery, and normal external discovery stay available. This is a skill_manage ownership policy, not an OS filesystem sandbox.

Verification

• scripts/run_tests.sh tests/tools/test_skill_manager_tool.py -k external_read_only -q — 19 passed
• scripts/run_tests.sh tests/tools/test_skill_manager_tool.py tests/tools/test_skill_usage.py tests/agent/test_external_skills.py tests/hermes_cli/test_config.py tests/tools/test_website_policy.py -q — 176 passed, 0 failed
• python3 -m py_compile tools/skill_manager_tool.py hermes_cli/config_defaults.py agent/skill_utils.py agent/prompt_builder.py
• git diff --check origin/main...HEAD

Local ruff is unavailable in this worktree and Nix is not installed; upstream CI remains the lint gate.

Rollback

Set skills.external_read_only: false to restore the existing foreground-edit behavior, or revert these two commits. No change affects ordinary file or terminal tools.