fix(config): preserve owner on atomic writes

[hashbender]

What does this PR do?

Preserves the existing uid/gid when Hermes rewrites files through the shared atomic JSON/YAML write helpers.

The root cause is that os.replace() swaps in the temporary file. When a command is run as root against a Docker/NAS-backed Hermes home, the temp file can be root-owned even if the original config.yaml was owned by the runtime user. Mode preservation alone does not prevent the replacement file from becoming unreadable to the Hermes process.

This restores the original owner on POSIX platforms after the atomic replace, best effort. Unsupported platforms and unprivileged callers continue normally if ownership cannot be changed.

Related Issue

No GitHub issue. Reported from support logs showing /opt/data/config.yaml becoming unreadable after a gateway setup/config write.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• utils.py: capture the original file owner before atomic JSON/YAML writes and restore it after atomic_replace().
• utils.py: apply the same owner preservation to atomic_roundtrip_yaml_update().
• tests/test_atomic_replace_symlinks.py: add focused tests for JSON writes, YAML writes through symlinks, and roundtrip YAML updates without requiring root.

How to Test

1. Run the focused atomic-write test file:
   pytest tests/test_atomic_replace_symlinks.py -q
2. Run the adjacent atomic JSON/YAML smoke set:
   pytest tests/test_atomic_replace_symlinks.py tests/hermes_cli/test_atomic_json_write.py tests/hermes_cli/test_atomic_yaml_write.py tests/test_yaml_indent_consistency_31999.py -q
3. In a Docker-style install, start with a runtime-owned config file, run a root-owned setup/config write path, and confirm the rewritten config.yaml keeps the original owner.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL2/Linux focused pytest

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Focused local checks:

pytest tests/test_atomic_replace_symlinks.py -q
17 passed in 0.25s

pytest tests/test_atomic_replace_symlinks.py tests/hermes_cli/test_atomic_json_write.py tests/hermes_cli/test_atomic_yaml_write.py tests/test_yaml_indent_consistency_31999.py -q
44 passed in 0.89s

Full pytest tests/ -q was not run locally; this PR came from support triage and the local run was intentionally scoped to the touched atomic-write behavior.

---

Mirror-of: NousResearch#56644
NousResearch#56644