fix(gateway): prefer systemd scope for timeout check

[ruizanthony]

Summary

• Detect the running systemd manager from /proc/self/cgroup before checking TimeoutStopUSec.
• Prefer the system manager for services under /system.slice and the user manager for /user.slice.
• Add regression coverage for the false-positive case where a stale inactive user unit reports 90s while the active system unit is correctly configured at 210s.

Why

Gateway startup could warn that a systemd unit was stale even when the running service was a system unit with a correct TimeoutStopSec. The check queried systemctl --user first, so a same-named inactive user unit could produce a false TimeoutStopSec=90s mismatch.

Test plan

• python -m py_compile gateway/shutdown_forensics.py tests/gateway/test_shutdown_forensics.py
• python -m pytest tests/gateway/test_shutdown_forensics.py -q -o 'addopts=' --tb=short

[teknium1]

Thanks for the focused regression fix. Current main still tries systemctl --user before the system manager and accepts the first parseable result (gateway/shutdown_forensics.py:363-389), which permits the false positive documented in linked issue #63158. This PR uses the running unit's cgroup scope to select the appropriate manager and adds a system-scope regression case.

The patch hunk context matches current main, is limited to the diagnostic path and its tests, and introduces no config, tool-schema, caching, or message-flow changes. This is an automated hermes-sweeper review.

[ruizanthony]

Rebased cleanly onto current main. Exact head: 65e1745148f20cfc585ed2460e9a666a1f5ab355; targeted shutdown-forensics gate: 31 passed; diff check clean. Please re-review.

[ruizanthony]

Attribution gate fixed by rewriting the unchanged commit with the repository-approved author identity. New exact head: 07dcd680f59bfc40b2269e9367e0cf711c671481; CI restarted.