fix(gateway): don't accept systemd's not-found default for TimeoutStopUSec

[berlai-services]

What does this PR do?

systemctl show <unit> never errors for a unit that isn't loaded under the manager you queried
— it returns rc=0 plus the compiled-in template defaults (LoadState=not-found,
TimeoutStopUSec=1min 30s). check_systemd_timing_alignment() in
gateway/shutdown_forensics.py queried --user first and trusted whatever TimeoutStopUSec it
got back without checking LoadState. Gateways installed as system-managed units (confirmed
live in production, with a real TimeoutStopSec=240 override) had their --user query "succeed"
with the bogus 90s template default and never reached the system manager holding the real value —
producing false-positive timeout-misalignment warnings.

Fix: also fetch LoadState alongside TimeoutStopUSec, and only trust a TimeoutStopUSec
reading whose unit is actually loaded under the manager that answered. A not-found LoadState
is rejected and the check falls through to the next manager (or returns None if genuinely
unmanaged under both).

Related Issue

No tracked issue; found via live forensics on hermes-apiserver-henry.service.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• gateway/shutdown_forensics.py: check_systemd_timing_alignment() now fetches LoadState
  and rejects a TimeoutStopUSec reading when LoadState != loaded.
• tests/gateway/test_shutdown_forensics.py: added
  TestCheckSystemdTimingAlignmentManagerSelection with 3 regression tests:
  • test_uses_real_system_override_not_user_managers_not_found_default — system-managed unit
    with a real 240s override is read correctly instead of accepting --user's bogus 90s default.
  • test_genuinely_unmanaged_unit_is_not_falsely_flagged_as_mismatched — false-positive
    control: a unit genuinely unmanaged under either manager (LoadState=not-found from both)
    returns None, not a manufactured mismatch. Proves the fix doesn't just relocate the bug.
  • test_unit_genuinely_loaded_under_user_manager_is_accepted_directly — control for the
    already-working path.

How to Test

1. pip install -e . then pytest tests/gateway/test_shutdown_forensics.py -v — 33 passed
   (verified fresh on this branch, Python 3.11, 2026-07-28).
2. Active regression check: checked out the pre-fix version of gateway/shutdown_forensics.py
   against the new tests only — 2 of the 3 new tests fail on pre-fix code
   (test_uses_real_system_override_... asserts 90.0 == 240.0; the false-positive control
   asserts a manufactured mismatch dict is None and fails), confirming the tests actually
   discriminate the bug rather than being decorative.
3. Live: systemctl show hermes-apiserver-henry.service --property=TimeoutStopUSec under
   --system returns the real 240s override; the same unit queried --user returns the bogus
   90s template default with LoadState=not-found.

Checklist

Code

• My commit messages follow Conventional Commits (fix(gateway):)
• My PR contains only changes related to this fix (no unrelated commits)
• I've run pytest tests/gateway/test_shutdown_forensics.py -q and all tests pass
• I've added tests for my changes, including a false-positive control
• Tested on Ubuntu 22.04 (aerodeck), Python 3.11

Documentation & Housekeeping

• N/A — no config keys, docs, or cross-platform behavior changed

Screenshots / Logs

See "How to Test" above for the pre-fix vs post-fix pytest evidence.