fix(gateway): stop default replace in service runs

[LeonSGP43]

What does this PR do?

Stops service-generated gateway runs from hardcoding --replace into their startup command. Service units, launchd plists, and detached profile restart helpers should start a fresh gateway process, not implicitly request a destructive in-place replacement.

This keeps manual hermes gateway run --replace available for operators, while making the default managed-service path safer and less likely to self-trigger restart loops.

Related Issue

Fixes #23272

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Removed hardcoded --replace from _gateway_run_args_for_profile()
• Removed hardcoded --replace from generated systemd unit ExecStart lines
• Removed hardcoded --replace from generated launchd ProgramArguments
• Added regression coverage to ensure managed gateway launch paths omit --replace

How to Test

1. Run uv run --frozen pytest -q -o addopts='' tests/hermes_cli/test_gateway_service.py -k 'launchd_install_repairs_outdated_plist_without_force or systemd_unit_includes_profile or launchd_plist_includes_profile or gateway_run_args_for_profile_omit_replace'
2. Generate a systemd unit or launchd plist and confirm it uses gateway run without --replace
3. Confirm manual CLI usage can still explicitly pass --replace when desired

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 / local CLI service test slice

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• uv run --frozen pytest -q -o addopts='' tests/hermes_cli/test_gateway_service.py -k 'launchd_install_repairs_outdated_plist_without_force or systemd_unit_includes_profile or launchd_plist_includes_profile or gateway_run_args_for_profile_omit_replace'
• uv run --frozen ruff check hermes_cli/gateway.py tests/hermes_cli/test_gateway_service.py

[kshitijk4poor]

Thanks — closing because the premise no longer holds on main (verified @ f556edc10).

The generated systemd unit's ExecStart is ... -m hermes_cli.main gateway run with no --replace. --replace only appears in the detached-fallback launch command (_gateway_run_command()), not in the service unit. So service-managed runs already don't hardcode --replace. Closing as no-longer-applicable — thanks for raising it.