What does this PR do?

_write_task_script() and _install_startup_entry() both use Path.write_text() to write the scheduled-task .cmd script and the Startup-folder launcher directly. If the process is killed or crashes mid-write (OOM, power loss, SIGKILL during install), the target file is left partially written. On the next Windows login the Scheduled Task fires against a truncated script and the gateway silently never starts — with no diagnostic in Task Scheduler.

Type of Change

• Bug fix

Changes Made

• _write_task_script(): write to script_path.with_suffix('.tmp') first, then tmp.replace(script_path)
• _install_startup_entry(): same temp-file + atomic rename pattern

This matches the pattern already used throughout the codebase (cron/jobs.py, agent/google_oauth.py, agent/anthropic_adapter.py, etc.).

How to Test

1. Review hermes_cli/gateway_windows.py — _write_task_script() and _install_startup_entry()
2. Verify both now use with_suffix('.tmp') + tmp.replace() instead of direct write_text()
3. Run python -m pytest tests/ -q — no regressions expected

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix
• I've tested on my platform: Ubuntu 24.04 (WSL2)

Documentation & Housekeeping

• No documentation changes needed
• Cross-platform considered — fix is Windows-only code path, no Linux/macOS impact