fix(gateway): load display config from routed profile

[tianma-if]

Summary

• read gateway config from the active profile runtime scope when multiplexed turns set a profile-specific Hermes home
• preserve the existing module-level _hermes_home path for normal gateway config reads and tests that patch it directly
• add a regression test covering root vs routed-profile display settings

Fixes #58395.

Tests

• .venv/bin/python -m pytest tests/gateway/test_multiplex_phase0.py -q
• .venv/bin/python -m ruff check gateway/run.py tests/gateway/test_multiplex_phase0.py
• git diff --check