fix(desktop): stop app-managed gateway on backend shutdown

[QuarkAssistant]

Summary

• complement the startup orphan sweep now on main by covering graceful Desktop backend shutdown
• terminate the live app-managed gateway-restart child when the Desktop serve lifespan exits
• keep the shutdown regression isolated from the startup reaper and shared action-process state

TDD evidence

• RED: uv run pytest tests/hermes_cli/test_dashboard_admin_endpoints.py::test_desktop_lifespan_terminates_managed_gateway_restart -q failed because the gateway child was not terminated
• GREEN: the same regression passes after the fix
• Relevant suites: 327 passed, 1 skipped
• Blocking lint: uv run ruff check . passed
• Windows footgun scan: 944 file(s) scanned, no findings
• Real subprocess shutdown probe: managed child exited on SIGTERM with code -15

Fixes #77276

[teknium1]

Merged via PR #83542 — your commit(s) were cherry-picked onto current main with your authorship preserved in git log (rebase merge). Thank you for the contribution!

This follow-up PR completed the EMFILE hardening cluster after #83406: restart-path gateway orphan reap, Desktop-managed gateway termination on serve shutdown, SSH-spawn ulimit raise, and the dashboard iterdir→scandir fd-leak fixes. Everything was live-tested end-to-end on a real serve backend before merge, including a hostile unreadable-profile-dir fixture that surfaced (and fixed) a pre-existing /api/profiles 500 along the way.