fix(update): stop Windows gateways before mutating install

[helix4u]

What does this PR do?

Stops running Windows gateway processes before hermes update mutates the checkout or virtualenv, including the Desktop updater path that runs hermes update --yes --gateway --force.

The existing Windows hermes.exe concurrent-instance guard does not catch installed gateways because the scheduled/startup gateway wrapper runs through pythonw.exe -m hermes_cli.main ... gateway run. Those processes can still keep files from the checkout or venv locked while git/uv update the install. This PR uses the existing gateway PID discovery and planned-stop marker path so profile gateways drain cleanly before update mutation, then relaunches the paused profiles after the update completes.

This is intentionally separate from #39487, which pauses Windows gateways only when gateway_mode is false and therefore does not cover the Desktop --gateway --force update path.

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/main.py: add a Windows-only pre-update gateway pause that discovers all gateway PIDs, writes planned-stop markers for mapped profile gateways, force-stops unmapped/surviving matched gateway PIDs, and resumes mapped profile gateways after normal update exits.
• hermes_cli/main.py: hook the pause/resume around git and ZIP update mutation paths, including early Already up to date returns and atexit fallback for failure exits.
• tests/hermes_cli/test_update_concurrent_quarantine.py: cover mapped profile gateway pause marker behavior, unmapped PID escalation, and post-update profile relaunch.

How to Test

1. On Windows, install/start a gateway so it is running as a scheduled task/startup gateway through pythonw.exe.
2. Trigger Desktop update or run hermes update --yes --gateway --force.
3. Confirm the update stops the gateway before git/uv mutation, avoids file-lock failures from the running gateway process, then relaunches the paused profile gateway after update.

Local verification run here:

• python -m py_compile hermes_cli/main.py tests/hermes_cli/test_update_concurrent_quarantine.py
• git diff --check -- hermes_cli/main.py tests/hermes_cli/test_update_concurrent_quarantine.py

I did not run the full pytest suite locally.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: WSL/Linux syntax validation only; Windows runtime validation still needed

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

Local verification:

---

python -m py_compile hermes_cli/main.py tests/hermes_cli/test_update_concurrent_quarantine.py
git diff --check -- hermes_cli/main.py tests/hermes_cli/test_update_concurrent_quarantine.py

[helix4u]

[tonydwb]

Code Review Summary

Verdict: Approved

Fix: on Windows, stop running gateway processes before mutating the Hermes install directory. Without this, file locks on gateway DLLs cause corrupted reinstalls or failures.

Looks Good

• Proper process enumeration and graceful shutdown with SIGTERM, then SIGKILL as fallback
• Profiles with running gateways are detected and warned separately
• Print statements are intentional CLI user feedback, not debug artifacts
• No security concerns

[pefontana]

Closing this one since it already landed in main as 78c11d99e back on 6/13. Same commit, just the earlier copy here, and the branch is way behind now so there's nothing left to merge.