secure: harden Hermes setup workspace permissions

[levineam]

Motivation

• The Hermes setup previously created the user workspace and personal-context files using the caller's default umask, resulting in world-readable directories and files on permissive systems.
• The workspace and templates (USER.md, MEMORY.md, ONTOLOGY.md) can contain sensitive personal data and must be owner-only by default.
• The setup should also avoid following attacker-controlled symlinks when writing those sensitive files.

Description

• Enforce owner-only creation by setting umask 077 at the top of runtimes/hermes/setup.sh.
• Refuse to accept a symlink as the workspace input by erroring out when WORKSPACE_INPUT is a symlink.
• Ensure the created workspace directory is owner-only by running chmod 700 on the workspace path after mkdir -p.
• Refuse to write through workspace file symlinks by checking for and rejecting symlink targets for sensitive filenames before copying.
• Harden existing and newly created behavioral and personal files by applying chmod 600 to AGENTS.md, SOUL.md, IDENTITY.md, USER.md, MEMORY.md, ONTOLOGY.md, and TOOLS.md at the end of setup.

Testing

• Verified script syntax with bash -n runtimes/hermes/setup.sh, which succeeded.
• Ran the Hermes artifact test with node --test runtimes/hermes/test/artifact-generation.test.js, which passed.
• Performed an automated permission check under a permissive umask 022 and confirmed the workspace directory is 0700 and the listed sensitive files are 0600.
• Verified symlink protection by creating a symlinked workspace and confirming the script exits and logs Refusing to use a symlink as expected.

---

Codex Task