What does this PR do?

Adds -- separator between setsid and bash in both the detached restart and gateway update code paths. Without this separator, Termux's setsid interprets -lc/-c as its own flags instead of forwarding them to bash, causing command execution to fail silently on Android/Termux.

Related Issue

Fixes #37124

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• gateway/run.py: Insert "--" between setsid_bin and "bash" in _launch_detached_restart_command() (line 3985) and _handle_update_command() (line 14821)
• tests/gateway/test_restart_drain.py: Update existing assertion to expect the -- separator in the command list
• tests/gateway/test_setsid_separator.py: Add focused regression tests verifying both the setsid and non-setsid code paths

How to Test

1. Run pytest tests/gateway/test_setsid_separator.py -v — both tests should pass
2. Run pytest tests/gateway/test_restart_drain.py -v — the updated assertion should pass
3. On Termux: verify that hermes gateway restart and hermes update no longer fail silently
4. On Linux/macOS: verify that gateway restart and update still work normally (the -- is a no-op on standard setsid)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/gateway/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: gateway/run.py _launch_detached_restart_command() and _handle_update_command() (setsid subprocess spawning)
• Blast radius: LOW — only affects Termux/Android users; standard Linux setsid ignores the extra --
• Related patterns: POSIX argument separator convention; both call sites use identical setsid_bin + bash invocation pattern