fix(update): preserve non-prefixed systemd gateway process

[pankajarm]

Summary

Fixes an updater safety gap for non-prefixed systemd-managed Hermes gateways.

hermes update already excludes active hermes-gateway* service PIDs from its manual-process sweep. A valid gateway run owned by a custom system unit (for example gaiasignal-agent-hermes.service) was not in that set, then was rediscovered as a manual process and sent SIGTERM.

This focused patch classifies only existing positive gateway run candidates at the update manual-sweep boundary using /proc/<pid>/cgroup:

• cgroup v2 0::/...unit.service and v1 name=systemd:/...unit.service => managed service, never raw-SIGTERM;
• confirmed non-service membership => preserves the existing manual-cleanup behavior;
• unreadable/ambiguous cgroup on Linux => fail safe and do not terminate;
• no broad systemctl enumeration and no unit-name-prefix trust.

Why

A real custom systemd service was interrupted by the generic updater and systemd recovered it roughly five seconds later. The update code must not treat system-manager ownership as manual merely because the unit name is outside the standard hermes-gateway* convention.

Verification

Fork branch commit 2ece25503:

uv sync --extra dev
.venv/bin/python -B -m pytest -p no:cacheprovider -q \
  tests/hermes_cli/test_update_gateway_pid_classification.py \
  tests/hermes_cli/test_update*.py tests/hermes_cli/test_gateway.py
# 162 passed

Reviewed/rebased validation commit 02f1a138 on current upstream 8f271272:

# 164 update + gateway tests passed
.venv/bin/python -B -m ruff check hermes_cli/update_cmd.py \
  tests/hermes_cli/test_update_gateway_pid_classification.py
.venv/bin/python -B -m py_compile hermes_cli/update_cmd.py
git diff --check

The new focused coverage verifies custom v2 and legacy v1 service cgroups, normal manual session scopes, unreadable cgroups, a false capability-probe path, non-systemd manual behavior, and preservation of targeted existing service discovery. A read-only check classified the affected live service PID as managed (True) without updating or restarting it.

Scope / safety

• Exactly two files; no dependencies, workflow files, or production changes.
• Independent evaluator and full Consensus Board approved the final two-file change.
• This draft intentionally does not authorize local deployment or a service restart.

Maintainer note

The personal fork is 534 commits behind current main because its PAT cannot push inherited workflow-file updates. GitHub compare shows this branch is ahead by one commit with exactly these two file changes. Please rebase/cherry-pick the focused patch onto current main before merging.

Related context: closed unmerged #5409 added the existing standard-service exclusion; open #20488 and #16349 concern status/profile reporting rather than update-time termination; open #77854 addresses updater-owning standard gateway lifecycle and is currently dirty. No exact duplicate was found.

[monerostar]

Ubuntu 26.04 LTS / kernel 7.0.0-28-generic on a local 5800X box. Read-only /proc check, no hermes update run.

origin/main 4a6d3640b has neither _systemd_service_membership_for_pid nor _select_update_manual_gateway_pids.

PR tip 2ece25503 against live PIDs:

• gateway MainPID 1965554 cgroup .../app.slice/hermes-gateway-main.service -> True
• session-scope pid 6521 .../session-5.scope -> False
• init.scope pid 1 -> False
• select([gateway, session], known_service_pids=empty, systemd_supported=True) -> [6521] only

So a prefixed unit is already safe, and a custom-named .service cgroup would also stay out of the raw SIGTERM sweep.

PYTHONPATH=$WT pytest tests/hermes_cli/test_update_gateway_pid_classification.py -o addopts=: 8 passed.

Looks good from Linux.