Bug Description

save_config_value() writes user preference changes into the repo/project fallback cli-config.yaml whenever ~/.hermes/config.yaml does not already exist.

Affected files / lines

• cli.py:1525-1528 — chooses project_config_path whenever user_config_path.exists() is false
• cli.py:1552-1553 — persists the mutation to the chosen path

Why this is a bug

On first-run or any environment where ~/.hermes/config.yaml is absent, user-triggered config updates mutate the installation's fallback config instead of creating the user config file. That can:

• write into a shared repo checkout
• fail on read-only installations
• make per-user settings unexpectedly global/project-scoped

Minimal reproduction

cd /Users/genie/.hermes/hermes-agent
source venv/bin/activate
python - <<'PY'
import tempfile
from pathlib import Path
from unittest.mock import patch
import cli, utils

captured = {}
with tempfile.TemporaryDirectory() as td:
    home = Path(td)
    with patch.object(cli, "_hermes_home", home), \
         patch.object(utils, "atomic_yaml_write", side_effect=lambda path, data: captured.setdefault("path", str(path))):
        ok = cli.save_config_value("display.skin", "ares")
        print("ok", ok)
        print("path", captured.get("path"))
PY

Observed path:

• /Users/genie/.hermes/hermes-agent/cli-config.yaml

Expected Behavior

Missing user config should cause Hermes to create/write ~/.hermes/config.yaml and leave the repo fallback untouched.

Actual Behavior

The write targets the project fallback cli-config.yaml.

Suggested investigation direction

Keep fallback precedence for reads, but always persist user-initiated changes to user_config_path (creating it if needed). Add a regression test for the missing-user-config case.