fix(dashboard): skill installs from the dashboard silently auto-cancel (#45150)

The dashboard's /api/skills/hub/install (and the new-profile hub_skills
path) spawned `hermes skills install <id>` with stdin=DEVNULL but
without --yes. do_install()'s 'Confirm [y/N]' prompt hit EOF, defaulted
to 'n', and printed 'Installation cancelled.' into a background log the
user never sees — every dashboard install no-opped.

Pass --yes on both spawn sites, matching the uninstall endpoint which
already passed --yes. The dashboard install button is the explicit user
consent, same as the TUI/slash-command skip_confirm rationale.

Repro: spawned the exact argv with stdin=DEVNULL against a temp
HERMES_HOME — without --yes it cancels, with --yes the skill installs.

tests/hermes_cli/test_web_server_skills_profiles.py

@@ -178,7 +178,10 @@ class TestProfileScopedHubActions:
         )
         assert resp.status_code == 200
         assert calls == [
-            (["-p", "worker_alpha", "skills", "install", "official/demo"], "skills-install")
+            (
+                ["-p", "worker_alpha", "skills", "install", "official/demo", "--yes"],
+                "skills-install",
+            )
         ]
 
     def test_hub_install_without_profile_keeps_legacy_argv(
@@ -200,7 +203,7 @@ class TestProfileScopedHubActions:
             "/api/skills/hub/install", json={"identifier": "official/demo"}
         )
         assert resp.status_code == 200
-        assert calls == [["skills", "install", "official/demo"]]
+        assert calls == [["skills", "install", "official/demo", "--yes"]]
 
     def test_hub_install_unknown_profile_404(self, client, isolated_profiles):
         resp = client.post(