Seed bundled skills for WebUI profile creation

[Michaelyklam]

Summary

• seed bundled profile skills after Web UI creates a non-cloned profile
• keep clone-based profile creation unchanged so clones do not receive a second bundled-skill overlay
• treat skill seeding as best-effort and continue profile creation with a warning on seed failure
• add focused regression coverage and a changelog entry

Closes #2305
Refs #749

Verification

• git diff --check
• python -m py_compile api/profiles.py
• pytest -q tests/test_issue2305_profile_create_seeds_skills.py tests/test_issue749_profile_create_model_picker.py tests/test_sprint31.py

[nesquena-hermes]

Summary

Reading the diff against origin/master:api/profiles.py:1140-1145 and the 262-line test file, this is a clean, well-isolated implementation of the fix the maintainer endorsed in #2305. Note this is one of two parallel PRs for #2305 (the other is #2314 by @WanderWang) — the maintainer will need to pick one.

Code reference

api/profiles.py:1062-1083, placed between profile_path.mkdir(...) and _write_endpoint_to_config(...):

profile_path.mkdir(parents=True, exist_ok=True)

# Seed bundled skills for non-cloned profiles (#2305).
# Cloned profiles should preserve the clone-source behaviour and must not
# receive a second bundled-skill overlay.
if clone_from is None:
    try:
        from hermes_cli.profiles import seed_profile_skills
        seed_profile_skills(profile_path, quiet=True)
    except ImportError:
        logger.debug(...)
    except Exception:
        logger.warning(..., exc_info=True)

_write_endpoint_to_config(profile_path, base_url=base_url, api_key=api_key)

I verified hermes_cli.profiles.seed_profile_skills at hermes_cli/profiles.py:673 accepts (profile_dir: Path, quiet: bool = False) and returns an optional dict — call signature is correct. The split between ImportError (debug) and Exception (warning with exc_info=True) is the right ergonomic: the Docker/standalone fallback path where hermes_cli isn't importable should be quiet, but a real seed failure should produce a stack trace.

The placement after mkdir and before the endpoint/model writes is slightly different from PR #2314, which puts the seed call after _write_model_defaults_to_config. Either is defensible; this PR's ordering means an endpoint/model write failure won't prevent skills from being seeded, which matches the spirit of "skills are independent of credentials." Not a strong opinion either way.

Tests

The 5-test suite at tests/test_issue2305_profile_create_seeds_skills.py covers:

1. test_seed_called_once_with_resolved_path — happy path, asserts call count and path
2. test_seed_not_called_when_clone_from_is_set — clone-from gate
3. test_seed_raising_logs_warning_and_still_returns_profile — best-effort
4. test_fallback_create_still_produces_profile_dict — _create_profile_fallback path
5. test_seed_unavailable_logs_debug_without_crashing — ImportError branch

The fixture pattern in _install_hermes_cli_profiles_mock (lines 67-77) directly assigns to sys.modules['hermes_cli.profiles'] before calling create_profile_api, then restores in finally. Since from hermes_cli.profiles import seed_profile_skills inside create_profile_api resolves at call time, this avoids the more fragile reimport-of-api.profiles pattern that PR #2314 uses. Cleaner, less side-effect-prone.

One minor: _real_hermes_cli is captured at module-import time on line 80, but if pytest's collection order makes another test file import hermes_cli after this file is collected, the saved reference will be stale. In practice the hermes_cli module is either present at session start or never present in the WebUI test env, so this is unlikely to bite — but worth being aware of.

Verdict

LGTM. Code change matches maintainer's preferred direction from #2305 exactly. Tests are thorough, isolated, and avoid the module-reload footgun. CHANGELOG entry present at CHANGELOG.md:5-7.

Comparison with parallel PR #2314 (filed ~30 minutes earlier by @WanderWang): the production code is functionally equivalent, but this PR's test isolation is materially cleaner — no sys.modules['api.profiles'] deletion / importlib.reload dance, and the fixture properly restores prior hermes_cli module state via try/finally. If the maintainer is choosing between the two, the test scaffolding here is a measurable point in this PR's favour.