fix: block persistent gateway self-restart jobs

[John-Lussier]

Summary

A real macOS gateway session scheduled a delayed shell helper through launchd's submitted-job primitive. launchd registered it as persistent (OnDemand=false), so the helper slept 45 seconds, restarted the gateway, exited successfully, and was relaunched. It produced 762 restart cycles before removal.

This patch closes the indirect execution path in the existing gateway lifecycle guard:

• rejects persistent submitted launchd jobs from gateway terminal sessions
• scans directly executed, shell-wrapped, -c, relative-cwd, executable-shebang, and nested shell scripts
• detects hidden gateway lifecycle and persistent launchd submission operations inside referenced scripts
• resolves scripts against the same live session cwd used for execution
• uses bounded, nonblocking, regular-file-only reads with recursion limits
• preserves safe shell scripts and quoted explanatory text
• applies the same persistent-job rejection to cron script creation

Verification

• 78 passed — tests/hermes_cli/test_gateway_restart_loop.py
• 679 passed — tests/cron
• 156 passed — focused terminal-tool suites
• git diff --check

An independent adversarial review found hidden-script, live-cwd, parser, and unbounded-read gaps in the first realization; the second commit adds regression coverage and closes each one.

[teknium1]

Thanks for pursuing a real gateway-loop gap. The premise is confirmed on current main: the gateway terminal guard only calls _contains_gateway_lifecycle_command at tools/terminal_tool.py:2275-2277, while the matcher at cron/lifecycle_guard.py:48-66 does not cover launchctl submit or referenced scripts.

Problems

• In PR commit 1824941eff36044c28f32805276e644680a3a568, the new guard_cwd call does not pass prev_owner=prev_cwd_owner. Current main's resolver rejects stale shared env.cwd only when that ownership value is supplied (tools/terminal_tool.py:2001-2023); execution does supply it at tools/terminal_tool.py:2651-2655. The guard can scan a prior session's directory while the command executes in another one.
• The new scanner uses host-side file reads, but SSH/Modal/Daytona are remote backends (tools/environments/base.py:1034-1041). Missing host paths are allowed, so referenced scripts on those backends are not inspected.
• The cron creation path added at cron/lifecycle_guard.py:336-339 still uses only direct matchers, not the new recursive scanner; a cron wrapper script can still invoke a child containing the prohibited operation.

Suggested changes

• Preserve the execution CWD ownership semantics in the guard and add a two-session regression.
• Make script inspection backend-aware, with remote-backend coverage.
• Reuse the recursive scanner for resolved cron scripts and test a nested wrapper.

Automated hermes-sweeper review.

[John-Lussier]

Rebased onto current origin/main and resolved the three concrete review items:

1. Live session cwd: the guard now resolves against get_session_cwd(session_key) first; when no session record exists yet, it falls back to env.cwd. This matches the current per-session cwd architecture on main and closes the stale-shared-cwd bypass.

2. Remote-backend script reads: referenced scripts are read locally first; if the local path is missing, the guard falls back to env.execute("cat ...") so SSH/Modal/Daytona backends are covered without penalizing local fast-path tests.

3. Recursive cron scanner: check_gateway_lifecycle() now uses the recursive _contains_unsafe_gateway_action() scanner, so nested cron wrapper scripts (e.g. outer.sh → inner.sh) are caught. Relative references inside a script resolve against that script's directory.

Verification:

• tests/hermes_cli/test_gateway_restart_loop.py — 80 passed (added regressions for remote reads, two-session cwd, nested cron wrappers).
• tests/cron — 694 passed.
• ruff check and git diff --check clean.

Fresh head: 1c8721d90.

[teknium1]

Merged via PR #75972 (#75972) — your three commits (label-independent submit blocker + bounded recursive referenced-script scanner) were cherry-picked verbatim with your authorship preserved, extended to cover the bootstrap variant. Yours was the cleanest of the three candidate fixes. Fixes #62891. Thanks!