Salvage of #19876 onto current main.

Adds a short-lived .gateway-planned-stop.json marker so deliberate stop paths (hermes gateway stop, systemd stop, launchd stop, profile-scoped stop) and foreground Ctrl+C can be distinguished from an unexpected external SIGTERM. On a planned stop the gateway exits code 0 so service managers (most notably launchd KeepAlive, and --replace takeover races) don't immediately revive it with stale platform identities (Feishu app_id, Telegram getUpdates, etc.).

Follows the existing --replace takeover-marker pattern — factored into a shared _consume_pid_marker_for_self() helper in gateway/status.py.

Note: this closes the revival / identity-conflict class, but does NOT fix slow drains on wedged adapter sockets (e.g. WSL with a hung Feishu websocket). That's the separate drain-hang issue tracked in a follow-up.

Changes

• gateway/status.py: write_planned_stop_marker(), consume_planned_stop_marker_for_self(), clear_planned_stop_marker(); shared _consume_pid_marker_for_self() helper
• hermes_cli/gateway.py: stop_profile_gateway(), systemd_stop(), launchd_stop() write the marker before SIGTERM
• gateway/run.py: signal handler consumes the marker, treats SIGINT as a planned foreground stop, exits cleanly
• tests/gateway/test_status.py + tests/hermes_cli/test_gateway_service.py: marker + systemd_stop wiring coverage, deterministic TimeoutStopSec assertions

Validation

• py_compile all three modified modules: clean
• scripts/run_tests.sh tests/gateway/test_status.py tests/hermes_cli/test_gateway_service.py tests/gateway/test_clean_shutdown_marker.py tests/gateway/test_runner_startup_failures.py: 171 passed

Credit to @helix4u — cherry-picked with authorship preserved. Closes #19876.