fix: preserve installed systemd context on gateway restart --system

[xiamulo]

Bug Description

gateway restart --system could decide that an installed systemd unit was stale using the current CLI process environment instead of the installed unit's own context, and then rewrite the unit with the wrong runtime paths.

In practice this meant a valid service installed for another user could be "refreshed" into a broken unit, including a bad ExecStart such as a resolved uv shared interpreter path.

Root Cause

The system-service freshness check and refresh path regenerated expected unit content from the current process environment (WorkingDirectory, VIRTUAL_ENV, HERMES_HOME, python path), rather than from the installed unit file being checked/refreshed.

That made gateway restart --system compare against the wrong context and rewrite the unit with incorrect paths.

Fix

• parse the installed systemd unit's WorkingDirectory and Environment= values
• derive generation context from the installed unit when checking or refreshing system services
• allow systemd unit generation to accept explicit overrides for python path, working directory, venv dir, and Hermes home
• keep the old non-system call pattern intact to avoid breaking existing tests/mocks
• add regressions for both stale-check correctness and repairing a broken ExecStart

How to Verify

1. Install or simulate a system unit whose WorkingDirectory/VIRTUAL_ENV point to a non-current environment.
2. Run gateway restart --system from a different environment/user context.
3. Confirm the unit is not rewritten when already correct, and that a broken ExecStart is repaired using the installed unit's venv path.

Test Plan

• Added regression test for this bug
• Existing tests still pass
• Manual verification of the fix

Commands run:

./venv/bin/python -m pytest -q tests/hermes_cli/test_gateway_service.py

Risk Assessment

Low — changes are scoped to systemd unit comparison/refresh for system services, and non-system behavior keeps the previous call path for compatibility.

[teknium1]

Already fixed on main via PR #8861 (salvage of #7735 by @akhater). The current code drops .resolve() entirely and uses .expanduser() for lexical-only expansion, preserving venv symlinks. Thanks for the contribution!