feat: mount skills directory into remote backends (Modal, Docker)

[teknium1]

Summary

Skills with scripts/, templates/, and references/ subdirectories need those files available inside sandboxed execution environments. Previously only individual credential files were mounted — the skills directory itself was completely absent from Modal/Docker sandboxes, meaning skill scripts couldn't be executed.

Reported by ilovescience (Tanishq) who uses Modal as a terminal backend — ~/.hermes/skills/ didn't exist at all in the sandbox.

Changes

File	Change
tools/credential_files.py	Add get_skills_directory_mount() — returns $HERMES_HOME/skills/ mount info
tools/credential_files.py	Fix name/path key fallback — skills using name in required_credential_files were silently skipped
tools/environments/modal.py	Mount skills dir via Mount.from_local_dir() at sandbox creation
tools/environments/docker.py	Mount skills dir as read-only bind mount
tests/tools/test_credential_files.py	8 new tests

How it works

The skills tree is mounted read-only at /root/.hermes/skills/ inside the container. This means:

• Skill scripts are executable in the remote env (python /root/.hermes/skills/.../scripts/setup.py)
• The agent's context references to skill paths resolve correctly
• No config, .env, auth.json, or other sensitive files leak — only the skills tree

Tests

• 8 new tests: name/path fallback, skills dir mount presence/absence, custom container base, missing file reporting
• 38 existing docker/modal tests pass
• All tools tests pass

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

326:+                    self._sandbox.process.exec(f"mkdir -p {parent}")
343:+                self._sandbox.process.exec(f"mkdir -p {container_root}")
351:+                        self._sandbox.process.exec(f"mkdir -p {remote_parent}")

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

465:+                    self._sandbox.process.exec(f"mkdir -p {parent}")
486:+                            self._sandbox.process.exec(f"mkdir -p {remote_parent}")

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

1249:+                    self._sandbox.process.exec(f"mkdir -p {parent}")
1270:+                            self._sandbox.process.exec(f"mkdir -p {remote_parent}")

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

1236:+            home = self._sandbox.process.exec("echo $HOME").result.strip()
1262:+                    self._sandbox.process.exec(f"mkdir -p {parent}")
1281:+                            self._sandbox.process.exec(f"mkdir -p {remote_parent}")

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

1420:+        b64 = base64.b64encode(content).decode("ascii")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

1236:+            home = self._sandbox.process.exec("echo $HOME").result.strip()
1267:+            self._sandbox.process.exec(f"mkdir -p {parent}")

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.