fix(docker): seed s6 gateway state for legacy gateway run containers

[teknium1]

Summary

Containers upgrading from the legacy tini image (command: gateway run in docker-compose) auto-start the gateway again after pulling the s6-overlay image. Previously the s6 reconciler saw no gateway_state.json, defaulted the gateway slot down, and left it silently stopped.

Salvage of #34829 by @donovan-yohan, cherry-picked onto current main with authorship preserved.

Changes

• hermes_cli/container_boot.py: when no root gateway_state.json exists and PID 1's argv is the legacy gateway run, seed root state as running so the reconciler brings the default slot up. Respects --no-supervise and HERMES_GATEWAY_NO_SUPERVISE. Only seeds when no state file exists, so explicit stopped/failed states keep winning.
• tests/hermes_cli/test_container_boot.py: regression coverage for legacy seed (bare + wrapped argv), both opt-outs, and explicit-stopped-wins.

Validation

• scripts/run_tests.sh tests/hermes_cli/test_container_boot.py — 31 passed
• E2E against a temp HERMES_HOME with real reconcile_profile_gateways() calls: legacy gateway run (bare + wrapped) seeds running and starts; --no-supervise (flag + env) does not seed and leaves the down marker; explicit pre-existing stopped is preserved; non-gateway-run cmd does not seed.

Closes #34339

Infographic

[teknium1]

@benbarclay tagging you for the container/s6 surface — this seeds root gateway_state.json to running when PID 1's argv is the legacy gateway run and no state file exists, so tini→s6 upgrades auto-start the gateway again. Respects --no-supervise and HERMES_GATEWAY_NO_SUPERVISE; explicit stopped state is preserved.

[github-actions]

🔎 Lint report: hermes/salvage-34829 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 9507 on HEAD, 9507 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 4931 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

Salvage of #34829 — cherry-picked onto current main with conflict resolution. Closes #34339.

[benbarclay]

Superseded by #34829, which landed in dcbf62e.

This PR's diff was byte-identical to #34829 (donovan-yohan's earlier PR). Thanks for the salvage @teknium1 — closing this one and crediting the original author. Both fixed #34339.