fix(gateway): avoid systemd restart loops on replace

[LeonSGP43]

Closes #32951

Summary

• change generated gateway systemd units from Restart=always to Restart=on-failure while keeping RestartForceExitStatus=75
• preserve graceful SIGUSR1-driven restarts for supervised services without reviving clean --replace takeovers
• lock the new restart policy into the existing user/system unit tests

Local proof

• pytest -q -o addopts= tests/hermes_cli/test_gateway_service.py -k "user_unit_avoids_recursive_execstop_and_uses_extended_stop_timeout or system_unit_avoids_recursive_execstop_and_uses_extended_stop_timeout"
• ruff check hermes_cli/gateway.py tests/hermes_cli/test_gateway_service.py
• git diff --check

[teknium1]

Thanks for the focused restart-policy fix. The specific supervised --replace loop is already eliminated on current main; this is an automated hermes-sweeper review.

• Commit 4d18717b6c798d4f6bab9e736c6ed10c5a8365f4 removed --replace from both generated systemd ExecStart templates specifically to prevent supervisor self-kill/restart loops.
• Current templates use plain gateway run at hermes_cli/gateway.py:2753 and hermes_cli/gateway.py:2790.
• Regression coverage at tests/hermes_cli/test_gateway_service.py:2554 asserts generated systemd units omit --replace and documents the same lifecycle rationale.

This matches the alternative accepted in #32951: make systemd-managed gateway startup safe by removing managed-service --replace takeovers.