fix(update): pause Windows gateway before venv refresh

[LeonSGP43]

Summary

• stop an installed Windows gateway service before the dependency refresh step in hermes update
• reuse the existing post-update gateway recovery path to resume the gateway after the update finishes
• add focused tests for pause/resume helpers and the update flow hook

Fixes #39431.

Verification

• `pytest -q -o addopts= tests/hermes_cli/test_update_concurrent_quarantine.py -k pause_windows_gateway

[teknium1]

Thanks for the focused Windows update fix. Current main already contains a broader implementation. This is an automated hermes-sweeper review.

• Commit 78c11d99e35b111dd6198d8bc6aa1f7f6f168232 (fix(update): stop Windows gateways before mutating install) shipped in v2026.6.19.
• hermes_cli/main.py:9029–9157 discovers all Windows gateway PIDs, gracefully pauses mapped profile gateways, and handles unmapped gateway processes before update mutation.
• hermes_cli/main.py:9490 invokes that pause before venv lock checks and update work; hermes_cli/main.py:9205–9268 and :11006 restore paused gateways.
• tests/hermes_cli/test_update_concurrent_quarantine.py:456–710 covers mapped/unmapped pause-resume paths and installed-gateway cold starts.
• The linked follow-up fix(update): stop Windows gateways before mutating install #45457 specifically addressed the Desktop --gateway --force gap in this PR's gateway_mode guard; current main covers that broader case.