fix(gateway,cron): guard cron model-tool path + auto-resume loop breaker (#30719)

[teknium1]

Summary

Completes the #30719 gateway restart-loop defenses. Defenses 1–2 already landed on main under different names; this closes the two remaining gaps and hardens the filter.

The foot-gun: an agent schedules hermes gateway restart (or launchctl kickstart ai.hermes.gateway), the cron fires → SIGTERM → supervisor KeepAlive revives the gateway → auto-resume replays the offending session → the turn re-runs the same logic. A ~10s SIGTERM-respawn loop until broken by hand (real macOS repro, 2026-05-22).

What was already on main

• Defense 1 — _HERMES_GATEWAY=1 guard: hermes gateway stop|restart refuse from inside the gateway, and terminal_tool hard-blocks lifecycle commands at execution time.
• Defense 2 (CLI layer) — hermes_cli.cron.cron_create rejected lifecycle prompts/scripts.

What this PR adds

• Defense 2 → chokepoint. The agent's cronjob model tool calls cron.jobs.create_job directly, bypassing the CLI filter, so model-tool-scheduled lifecycle jobs were only caught at execution. Moved the filter into a shared cron/lifecycle_guard.py enforced at create_job — the single path every caller (CLI + model tool) hits. _contains_gateway_lifecycle_command is re-exported from hermes_cli.cron so terminal_tool's import is unchanged. Relative script paths resolve under HERMES_HOME/scripts exactly as the scheduler runs them, so a bare script name is scanned as the file that actually executes.
• Defense 3 (new): auto-resume loop breaker. gateway/restart_loop_guard.py counts restart-interrupted boots in a rolling window (gateway.restart_loop_guard, default 3 boots / 60s) and skips auto-resume for that boot once tripped. The gateway still comes up and serves real inbound messages — it just stops replaying the session that keeps killing it, putting a human back in the loop. Catches every SIGTERM source defenses 1–2 don't (e.g. a raw terminal("launchctl kickstart …")). Fails open on any state error.
• Regex tightened over main's version: dropped benign hermes gateway start; require the gateway identifier on the launchctl/systemctl branches (launchctl unload ai.hermes.update-checker.plist and systemctl restart hermes-meta.service no longer false-positive); added the inverse pkill gateway … hermes token order; fixed the binary-script bypass (decode errors="replace" instead of swallowing UnicodeDecodeError).

Changes

• cron/lifecycle_guard.py (new): shared checker + check_gateway_lifecycle raising GatewayLifecycleBlocked.
• cron/jobs.py: enforce the guard in create_job.
• hermes_cli/cron.py: re-export the checker; drop the now-redundant CLI-layer guard.
• gateway/restart_loop_guard.py (new) + gateway/run.py: loop breaker + wiring in _schedule_resume_pending_sessions.
• hermes_cli/config.py: gateway.restart_loop_guard defaults.
• tests: tests/hermes_cli/test_gateway_restart_loop.py extended.

Validation

	Result
Targeted suite (restart-loop + gateway service + cronjob tools)	318 passed, 0 failed
Regression sweep (config + terminal_tool + cron/)	753 passed, 0 failed
E2E: agent cronjob create (prompt + script abuse)	blocked with #30719 hint
E2E: loop breaker (burst trips / spread ignored / disable)	correct
ruff	clean

Credit

Design and much of defense-2 originate from PR #33395 (@kshitijk4poor), which salvaged #30728 (@SimoKiihamaki). Rebuilt against current main because defenses 1–2 had already landed under different names (_HERMES_GATEWAY), so cherry-picking #33395 wholesale would have re-added a duplicate HERMES_IN_GATEWAY env flag. Both authors preserved as Co-authored-by.

Closes #30719.

Infographic