Hermes Agent can fail on read-only files

Hermes Agent may fail when its `patch` and `write_file` tools try to change an existing file with tight permissions. The failure happens during an atomic write, where the tool first creates a temporary file in the same folder and later replaces the original file. If the original file is set to mode 400, meaning read-only, Hermes Agent copies that permission to the temporary file before writing the new content.

The temporary file then becomes read-only too, so the write step is blocked and the final replace step never happens. Common signs include repeated permission errors on `.hermes-tmp` temporary files and warnings from the file-mutation verifier that the target file did not change. The error details can appear in `~/.hermes/logs/errors.log`.

This can affect restricted files such as 400 journal files and 600 config files, and the likely problem area is `_atomic_write_same_fs` in `/tools/file_operations.py`.