Summary

Preserve the authorized user message that triggers the gateway stale-code self-check before requesting a restart.

Problem

The stale-code self-check added for #17648 correctly detects when a long-running gateway survived an update and should restart before dispatching into stale imports.

However, the check currently returns a retry-after-restart notice without persisting the triggering message. For polling/event platforms such as Telegram, the update has already been consumed by the time _handle_message() returns. The gateway restarts, but the user's actual request is gone and the platform will not replay it.

Observed class: after a WebUI/Hermes update, Telegram messages received during the stale-code restart path were acknowledged with the restart notice but never delivered to the agent after restart.

Change

• Run the stale-code check after auth/plugin gates, so unauthorized input is not persisted.
• Before requesting restart, get/create the session entry, append the triggering user message to the transcript, and mark the session resume_pending with reason stale_code_restart.
• Extend the resume note so the next turn answers the preserved message first.
• Add a regression test proving the stale-code path persists the message and marks resume-pending before restart.

Tests

python -m py_compile gateway/run.py tests/gateway/test_stale_code_self_check.py
python -m pytest tests/gateway/test_stale_code_self_check.py tests/gateway/test_restart_resume_pending.py -q
# 69 passed

Refs #17648.