fix(gateway): Windows post-update respawn must mark itself detached (silent gateway death after in-app update)

[iso2kx]

Summary

On Windows, the post-update gateway respawn watcher launched the new gateway without marking it as a detached service, so the respawned gateway would die silently the moment the spawning console went away — leaving the user with no messaging gateway after an in-app update until a manual restart.

Root cause

_spawn_gateway_restart_watcher (in hermes_cli/gateway.py) respawns the gateway after the old PID exits. On Windows it set the right detach creation flags, but it did not:

• set HERMES_GATEWAY_DETACHED=1 in the child env, nor
• redirect the child's stdin to DEVNULL.

_windows_gateway_should_absorb_console_controls() decides whether the gateway installs the console-control guard (SetConsoleCtrlHandler(NULL, TRUE) + SIGINT/SIGBREAK ignore). It keys off HERMES_GATEWAY_DETACHED, falling back to sys.stdin.isatty(). Because the respawn carried neither signal, the new gateway inherited the spawning console, classed itself interactive, and skipped the guard.

It then died the instant Windows broadcast CTRL_CLOSE_EVENT / CTRL_LOGOFF_EVENT when the parent console (the post-update desktop shell) exited — no shutdown log, no traceback.

The gateway exit diagnostics captured the fingerprint exactly: the dead post-update gateway came up with stdin_is_tty=true, absorb_windows_console_controls=false, whereas every healthy detached gateway (autostart .cmd / _spawn_detached) shows true.

Fix

Mirror the canonical detached launch path (gateway_windows._spawn_detached) inside the respawn watcher:

• set HERMES_GATEWAY_DETACHED=1 in the child env, and
• redirect child stdin to DEVNULL (belt-and-braces: even if the env marker were ever dropped, the severed stdin keeps the isatty() fallback from misclassifying it).

This covers both respawn paths, since profile gateways (launch_detached_profile_gateway_restart) and unmapped / Scheduled-Task gateways (launch_detached_gateway_restart_by_cmdline) share this watcher.

Tests

Adds TestGatewayRestartWatcher:

• test_watcher_marks_respawn_detached_and_severs_stdin — asserts the watcher template sets the detached marker, severs stdin, and passes the env overlay to Popen (and that the template is valid Python).
• test_by_cmdline_spawns_watcher — asserts the by-cmdline entry point spawns the watcher with the expected argv shape.
• test_rejects_empty_inputs — guards the early-return validation.

pytest tests/hermes_cli/test_gateway.py -k "RestartWatcher or by_cmdline or detached_absorbs"
4 passed

No new failures introduced (the pre-existing Linux/Windows-only failures in this file — signal.SIGKILL, systemd-linger, Docker-root-guard — are unrelated and fail identically on a clean baseline).

[iso2kx]

Closing as a duplicate of #52239, which already sets HERMES_GATEWAY_DETACHED=1 in the post-update respawn watcher's env overlay — that's the core fix for the silent gateway death (the missing detached marker meant the respawn skipped the SetConsoleCtrlHandler guard and died on CTRL_CLOSE/LOGOFF). #52239 is broader (also fixes the persistent windowless-console issue via pythonw.exe) and predates this PR.

The only additive bit here was redirecting the respawn's stdin to DEVNULL as belt-and-braces, in case the env marker is ever dropped. Not worth a separate PR; deferring to #52239.