fix(hermes): write SOUL.md atomically and guard missing template in build-installation-context.py

[vaibhavsrv]

Why this matters

In ods/scripts/build-installation-context.py, render_installation_context() assembles the runtime persona file data/persona/SOUL.md by directly calling output_path.write_text(...) on the live path. Because SOUL.md is bind-mounted directly into the running ods-hermes container and inspected on new chat sessions, non-atomic writes expose a window where Hermes reads an empty or truncated persona file during installer runs or service restarts. Additionally, if the template path is missing or invalid, the function encounters an unhandled FileNotFoundError without contextual path information.

This patch adds a file verification guard on template_path and writes the assembled persona content to a peer .tmp file before performing an atomic rename via os.replace(). Existing persona assembly logic, marker replacement rules, and compact profiles remain untouched.

Validation

• Baseline: Writing large context directly to output_path exposed non-atomic write windows to concurrent container reads, and missing templates threw bare uncaught exceptions.
• Post-fix: render_installation_context() creates a temporary sibling file and atomically replaces data/persona/SOUL.md, verifying file integrity across concurrent reads.
• Hermes installation context suites: 3 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

• fix(amd-topo): guard non-numeric byte counts in amd_memory_type #6323 (fix(amd-topo): guard non-numeric byte counts in amd_memory_type) — GPU topology script classification; no persona template overlap.
• fix(pixel-inference): validate top_logprobs integer bounds #6322 (fix(pixel-inference): validate top_logprobs integer bounds) — API inference argument bounds; separate subsystem.
• fix(hermes): enforce trailing newline on patched hermes config #6085 (fix(hermes): enforce trailing newline on patched hermes config) — Hermes YAML config formatting, distinct from SOUL.md dynamic generation.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens file writing atomicity, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6323 at 5662f0d without conflicts. Production and test diffs passed together; Hermes persona generation checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.