fix(docker): chown gateway install tree on UID remap (salvage #37928)

[benbarclay]

Summary

Salvage of #37928 (@sarvesh1327), reduced to the still-needed delta.

/opt/hermes/gateway is a runtime-writable Python package: on first import the supervised gateway writes __pycache__ beneath it, and the image does not set PYTHONDONTWRITEBYTECODE. When HERMES_UID/PUID is remapped at boot (e.g. Unraid 99), usermod -u only re-chowns the hermes home dir; the build trees under /opt/hermes keep the build-time UID (10000). main already chowns .venv, ui-tui, and node_modules on remap (#38556) but missed gateway, so the remapped gateway hits EACCES writing __pycache__ (#27221).

This adds /opt/hermes/gateway to both chown sites:

• the Dockerfile build-time chown -R hermes:hermes line
• the stage2-hook build-tree ownership repair

so it tracks the remapped UID like its sibling trees.

Differences from #37928 as submitted

Dropped the uid_gid_remapped flag and the || [ "$uid_gid_remapped" = true ] chown gate. main's #38556 already solved that half, and more correctly — it probes the actual tree ownership (venv_owner != actual_hermes_uid) rather than tracking same-boot remaps, which also catches pre-existing ownership drift and stays idempotent. Keeping #37928's flag would regress that. The salvage is the gateway-tree addition only.

Credit preserved via Co-authored-by:.

Verification

Unit: test_dockerfile_node_modules_perms.py + new test_stage2_hook_install_dir_chown.py — 3 tests, green. shellcheck docker/stage2-hook.sh clean.

End-to-end against a real image build:

• Baseline main, boot HERMES_UID=99 HERMES_GID=100 → gateway stays 10000:10000; a write as uid 99 into gateway/ fails with EACCES (the [Bug]: entrypoint.sh misses chown for ui-tui/ and gateway/ when HERMES_UID is remapped #27221 bug).
• With this change → gateway is chowned to 99:100 alongside .venv/ui-tui/node_modules; the write succeeds.
• Control: default-uid (no remap) boot leaves gateway at 10000:10000 — no behavior change for the common path.

Fixes #27221.