fix(update): match gateways using full command lines

[acellm]

Summary

• use full Windows venv-holder command lines for internal gateway identity matching
• preserve argv boundaries for Windows paths containing spaces
• redact and cap command lines at 120 characters only when emitting human-facing blocker diagnostics
• require a real Hermes gateway entrypoint and first subcommand position, so unrelated venv processes remain blockers
• preserve the existing default truncated detector behavior and fail-closed update guard

Why

The Windows blocker detector shortened every process command line to 120 characters before gateway classification. With the managed install path and --profile quality-manager, the real command is 137 characters and was truncated before gateway run:

... -m hermes_cli.main --profile quality-ma

The Desktop preflight therefore reported the managed gateway as an unknown venv holder (pausable_gateways: 0) and aborted the update.

Using full command lines for identity checks also required tightening the shared matcher: gateway entrypoint text in ordinary script arguments must not exempt an unrelated process, and argv arrays must retain quoting around paths with spaces.

Safety

• full command lines stay internal to process classification
• diagnostics are redacted before being capped at 120 characters
• unknown/non-gateway venv holders still block the update
• matcher requires a real Hermes entrypoint and gateway as the first subcommand after profile selectors
• valid hermes, python -m hermes_cli.main, direct script, environment-prefix, versioned Python, and space-path launch forms remain supported

Validation

• uv run --with pytest --with pytest-xdist pytest -q -n auto tests/hermes_cli/test_scan_venv_blockers.py tests/hermes_cli/test_update_venv_health.py tests/hermes_cli/test_update_concurrent_quarantine.py tests/hermes_cli/test_gateway_external_supervisor.py tests/gateway/test_gateway_command_line_matcher.py tests/gateway/test_status.py tests/hermes_cli/test_gateway_proc_fallback.py tests/hermes_cli/test_gateway_service.py — 145 passed, 1 skipped
• uv run --with ruff ruff check ... on all ten changed Python files — passed
• python -m py_compile on all ten changed Python files — passed
• Windows process-table integration check against a real --profile quality-manager gateway run process:
  • full command length: 137
  • full command classified as pausable: true
  • legacy 120-character command classified as pausable: false
  • unrelated-holder false positives: 0/4
  • quoted C:\Program Files\... gateway path classified correctly: true
  • POSIX Python shebang/console-script gateway classified correctly: true
  • gateway restart remains runtime-only and is not classified as run: true

Follow-up to #74326.

[teknium1]

Thanks for isolating the Desktop handoff from the canonical updater lifecycle.

I verified the reported ordering defect against current remote main (9accf79d): apps/desktop/electron/main.ts performs the all-venv-holder scan after releasing Desktop-owned backends and returns before spawnUpdaterProcess(). Current hermes_cli/update_cmd.py pauses only registry-discovered gateway PIDs before its venv-holder guard.

This patch removes the duplicate Electron preflight, routes Command Center updates through the existing local/remote-aware requestActiveUpdate() path (apps/desktop/src/app/command-center/index.tsx:270), and extends the CLI pause flow with the existing strict gateway command matcher (hermes_cli/update_cmd.py:2723-2734). The added tests cover both a registry-missed gateway run --replace process and rejection of gateway status.

No blocking source-level issue found. This is an automated hermes-sweeper review.