fix: preserve resolved env refs across gateway reloads

[ramybarsoum]

Summary

• preserve already-resolved 1Password op:// dotenv values when reloading env files
• reuse the shared Hermes dotenv loader from cron jobs
• harden API server max-iteration parsing and add local launchd wrapper support
• let Google Workspace fall back to native gws auth when no Hermes profile token exists

Test Plan

• python -m pytest tests/hermes_cli/test_env_loader.py tests/gateway/test_runtime_env_reload_config_authority.py tests/gateway/test_config_env_bridge_authority.py tests/skills/test_google_workspace_api.py tests/skills/test_google_oauth_setup.py -q
• python -m pytest tests/skills/test_google_workspace_credential_files.py tests/cron/test_scheduler.py -q
• python -m pytest tests/hermes_cli/test_gateway_service.py::TestProfileArg::test_launchd_plist_includes_profile -q
• python -m py_compile cron/scheduler.py gateway/platforms/api_server.py hermes_cli/env_loader.py hermes_cli/gateway.py skills/productivity/google-workspace/scripts/google_api.py skills/productivity/google-workspace/scripts/setup.py

Note: full macOS gateway service suite had 6 unrelated systemd preflight failures on this host.

[liuhao1024]

Review: _ensure_authenticated() early return may mask auth failures

The new guard in google_api.py:

def _ensure_authenticated():
    if TOKEN_PATH.exists() or _gws_binary():
        return
    # ... original error + sys.exit(1) ...

Issue: _gws_binary() only checks whether the gws CLI binary is installed (via shutil.which), not whether it is authenticated. When gws is installed but has no valid credentials (no token at ~/.hermes/google_token.json and no native gws credential store), this function returns silently. Downstream code then attempts a real API call via gws, which fails with a less actionable error than the original "Not authenticated. Run the setup script first" message.

Suggested fix: Gate on actual authentication rather than binary presence. For example:

def _ensure_authenticated():
    if TOKEN_PATH.exists():
        return
    if _gws_binary() and _check_gws_native_auth(quiet=True):
        return
    print("Not authenticated. Run the setup script first:", file=sys.stderr)
    print(f"  python {Path(__file__).parent / 'setup.py'}", file=sys.stderr)
    sys.exit(1)

This way, a gws binary with no credentials still surfaces the actionable setup message.

---

Separately: this PR shares the same google_api.py / prompt_builder.py TERMINAL_CWD fix territory as #24985 and #24957 — worth confirming the intended overlap.

[ramybarsoum]

Closing this PR because it was opened in error from a local sync/update workflow. This was not intended as an upstream contribution request.