fix(cron): scan dot-operator sourced scripts in lifecycle guard (#77925)

[Mengchee118]

What does this PR do?

cron/lifecycle_guard.py scans scripts pulled in with the source builtin so a
gateway-lifecycle command inside them is blocked. The equivalent POSIX dot
operator was not caught, so . ./restart.sh was never scanned.

The executable test compared basename only:

executable_name = Path(executable).name
if executable_name in {".", "source"}:

Path(".").name is the empty string — pathlib normalises "." to the
current directory, whose .name is "" — so the "." entry could never match.
source matched; . silently fell through, the sourced script was never added
to the reference walk, and its contents were never scanned.

The fix compares the raw token as well as the basename:

if executable in {".", "source"} or executable_name == "source":

The executable_name == "source" arm is kept deliberately so a path-qualified
spelling keeps behaving as before, while the raw-token test catches . without
depending on pathlib normalisation.

Related Issue

Fixes #77925

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 🔒 Security fix

Changes Made

• cron/lifecycle_guard.py — _iter_referenced_shell_scripts: compare the raw
  executable token as well as the basename, so the dot operator reaches the
  referenced-script scan. Comment records why the basename test cannot work
  for ..
• tests/hermes_cli/test_gateway_restart_loop.py — three tests in
  TestLifecycleGuardModule.

How to Test

Reproduce on main (all three assertions describe current behaviour):

from pathlib import Path
from cron.lifecycle_guard import (
    contains_gateway_lifecycle_command_or_referenced_script as scan,
)

p = Path("/tmp/restart.sh")
p.write_text("#!/bin/bash\nhermes gateway restart\n")

assert scan(f". {p}") is False       # BUG on main: not blocked
assert scan(f"source {p}") is True   # blocked
assert scan(f"bash {p}") is True     # blocked

With this PR the first assertion becomes True.

Automated:

pytest tests/hermes_cli/test_gateway_restart_loop.py -q

• 85 passed with this PR.
• Reverting only cron/lifecycle_guard.py to main and keeping the new tests
  fails exactly test_dot_operator_sourced_script_is_scanned
  (AssertionError: assert False is True) — so the test genuinely covers the
  defect rather than passing vacuously.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've run pytest tests/hermes_cli/test_gateway_restart_loop.py -q and all tests pass (85 passed)
• I've added tests for my changes
• I've tested on my platform: macOS 26.6 (Apple Silicon)

Documentation & Housekeeping

• I've updated relevant documentation (docstrings/comments) — inline comment explains the pathlib subtlety
• cli-config.yaml.example — N/A, no config keys
• CONTRIBUTING.md / AGENTS.md — N/A, no architecture change
• Cross-platform impact considered — the fix removes a pathlib-normalisation
  dependency rather than adding one. . and source are POSIX-shell
  builtins, so behaviour is unchanged on Windows, where this walk is not
  reached for shell scripts.
• Tool descriptions/schemas — N/A, no tool behaviour change

Notes for reviewers

On duplicates: there are several open PRs on this file (#77383, #77729,
#77806, #77894) — all of them address the crash class (ValueError: embedded null byte). This is a different defect: a silent scan miss, no
crash involved. It does not overlap or conflict with those changes; the hunk is
40 lines away from the crash sites.

Scope: the same audit turned up a second, independent defect — the #76762
binary test (b"\x00" in data) treats any NUL-bearing file as an unscannable
binary, but bash executes a text script straight past an embedded NUL, so
a single pad byte bypasses the scan entirely. That is a separate PR; keeping
them apart so each can be reviewed on its own merits.