fix(windows): gateway-restart watcher leg must use windowless interpreter

[teknium1]

Summary

The real cause of the persistent "hermes update → gateway restarts → console window flashes and flurries" report on Windows — the one that survived #53791, #53810, and #53829.

Those PRs fixed the wrong layer. #53810 correctly rewrote the respawned gateway leg to the windowless base interpreter (windowless_gateway_restart_spec). But the watcher process that polls the old PID and spawns that gateway was still launched with bare sys.executable — the venv's console python.exe. On Windows that re-execs the base console interpreter and allocates a conhost window even under CREATE_NO_WINDOW. Two console-python legs per restart = flash, then flurry. The AST footgun checker could never catch this: it scans subprocess.* call sites, and this is a subprocess.Popen([sys.executable, ...]) — a dynamic argv it has no rule for.

Changes

• hermes_cli/gateway.py _spawn_gateway_restart_watcher: resolve watcher_argv[0] via _resolve_detached_python (the same windowless base interpreter the gateway leg already uses), and overlay VIRTUAL_ENV/PYTHONPATH so the base interpreter can import hermes_cli in the inlined watcher snippet. No-op on POSIX (no w variant; start_new_session path unchanged).
• Regression test pins the watcher leg to the windowless interpreter (static source check, refactor-proof).

Validation

	Before	After
Respawned gateway interpreter	windowless ✓ (#53810)	windowless ✓
Watcher interpreter (Windows)	console python.exe → flash	windowless base + env overlay
tests/tools/test_windows_native_support.py	66	67 pass (+regression)

Honest caveat: this is a code-reasoned fix mirroring the proven _spawn_detached / windowless_gateway_restart_spec pattern. It has not been run on native Windows — that's the exact gap that let the earlier three PRs ship without catching this. Needs a Windows smoke pass on the hermes update → restart path to confirm the flurry is gone.

Infographic

[github-actions]

🔎 Lint report: inspect/windows-popups vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11528 on HEAD, 11526 on base (🆕 +2)

🆕 New issues (2):

Rule	Count
unresolved-attribute	2

First entries

run_agent.py:3014: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`
tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`

✅ Fixed issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

Unchanged: 6070 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[teknium1]

Closing in favor of reverting the whole Windows terminal-popup line of work (#53853). This watcher fix was never verified on Windows either; we are resetting to baseline and will fix from a real Windows repro. The diagnosis here (watcher leg launched the console python.exe) is captured in #53853 and the revert PR notes for whoever picks this up.