fix(automation): protect managed skill ownership

[ScriptedAlchemy]

Summary

• restrict managed-skill export and reconciliation to the real user profile
• permit skill-writer updates and consolidation only for automation-owned skills
• isolate subprocess-heavy test harnesses to prevent aggregate-suite interference

Verification

• cargo test-all --status-level fail --final-status-level fail (4665 passed, 2 skipped)
• cargo dogfood
• tracedecay doctor reports Codex and Claude materializations in sync
• installed upstream Hermes Agent inspected read-only; no Hermes code changed

[changeset-bot]

⚠️ No Changeset found

Latest commit: 31d3aee

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR