fix: resolve review blockers (D1, D2, D3) and reconcile.sh subprocess bugs

.agents/skills/lib.sh

@@ -58,12 +58,6 @@ _resolve_real_herdr_path() {
 _init_herdr_isolation() {
   local wrapper_dir="$WORKSPACE_ROOT/.mam/shim"
   mkdir -p "$wrapper_dir"
-  if [ -x "$wrapper_dir/herdr" ]; then
-    if [[ ":$PATH:" != *":$wrapper_dir:"* ]]; then
-      export PATH="$wrapper_dir:$PATH"
-    fi
-    return 0
-  fi
 
   local tmp_file
   tmp_file=$(mktemp "$wrapper_dir/herdr.XXXXXX")
@@ -224,7 +218,7 @@ print('\t'.join(env_flags) + '\n' + ' '.join(binary_tokens))
     # Resolve ws_id and split direction:
     # - If we have up to 3 agents, split 'right' (columns)
     # - If we have 4 or more agents, split 'down' (rows)
-    res=$(WS_CWD="${ws:-.}" _real_herdr workspace list 2>/dev/null | python3 -c "
+    res=$(_real_herdr workspace list 2>/dev/null | WS_CWD="${ws:-.}" python3 -c "
 import sys, json, os
 try:
     target_label = os.path.basename(os.path.abspath(os.environ.get('WS_CWD', '.')))
@@ -477,7 +471,11 @@ except Exception:
 esac
 EOF
   chmod +x "$tmp_file"
-  mv -f "$tmp_file" "$wrapper_dir/herdr"
+  if [ -f "$wrapper_dir/herdr" ] && cmp -s "$tmp_file" "$wrapper_dir/herdr"; then
+    rm -f "$tmp_file"
+  else
+    mv -f "$tmp_file" "$wrapper_dir/herdr"
+  fi
   if [[ ":$PATH:" != *":$wrapper_dir:"* ]]; then
     export PATH="$wrapper_dir:$PATH"
   fi
@@ -1261,7 +1259,8 @@ isolation_env_prefix() {
   local agent="$1" root="$2"
   case "$agent" in
     claude)     printf 'CLAUDE_CONFIG_DIR=%q ' "$root" ;;
-    agy|hermes) printf 'HOME=%q https_proxy=http://127.0.0.1:9999 no_proxy=googleapis.com ' "$root" ;;
+    agy)        printf 'HOME=%q https_proxy=http://127.0.0.1:9999 no_proxy=googleapis.com ' "$root" ;;
+    hermes)     printf 'HOME=%q ' "$root" ;;
     *) : ;;
   esac
 }