fix(gateway): retry detached restart helper without job breakaway on Windows

[askie]

Problem

On Windows, when the gateway runs inside a job object that disallows breakaway (no JOB_OBJECT_LIMIT_BREAKAWAY_OK — e.g. when started via Task Scheduler), CreateProcess with CREATE_BREAKAWAY_FROM_JOB fails with ERROR_ACCESS_DENIED, which Python surfaces as PermissionError.

GatewayRunner._launch_detached_restart_command lets that exception escape. The caller in request_restart only logs it (Failed to launch detached gateway restart helper: [WinError 5] Access is denied) and then proceeds with stop(restart=True) anyway — so the gateway shuts down for the planned restart and never comes back until someone starts it manually.

This is reproducible in the wild: a messaging-platform plugin auto-update triggers a detached restart, the helper launch fails with WinError 5, and the gateway stays dead for days (the Task Scheduler entry only triggers at logon).

Fix

Retry the watcher spawn without CREATE_BREAKAWAY_FROM_JOB when the first Popen raises OSError — the exact fallback gateway_windows._spawn_detached already implements for the same documented condition, and the pattern windows_detach_flags_without_breakaway() was added for. Without the breakaway flag the watcher stays inside the job, which is still far better than no watcher at all.

Testing

• Added test_windows_detached_restart_retries_without_breakaway: first spawn raises PermissionError(5), asserts a second spawn happens with the no-breakaway flags and identical argv.
• pytest tests/gateway/test_restart_drain.py — 25 passed.
• Verified on a live Windows install where this bug bit twice: gateway now restarts cleanly through the same code path.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #42993. Both add the current-main outer watcher retry without CREATE_BREAKAWAY_FROM_JOB; #42993 is the earlier focused implementation and also handles a second spawn failure with safe diagnostics.

[teknium1]

Thanks for the focused Windows restart fix. This is now redundant with the earlier duplicate implementation.

• Automated hermes-sweeper review verified current main retries the outer restart watcher without CREATE_BREAKAWAY_FROM_JOB at gateway/run.py:7380-7396.
• Current main additionally handles a second spawn failure safely at gateway/run.py:7397-7416.
• Behavioral coverage is present in tests/tools/test_windows_native_support.py:1190-1253.
• The implementation landed from fix(gateway): retry detached restart watcher without breakaway #42993 via fix(gateway): retry detached restart watcher without breakaway (salvage #42993) #70262 as 30bb55588fc05dc2afea9fdeef8d8f5fe016cb72.

Closing as implemented on main.