fix(update): bypass systemd RestartSec after graceful drain

[teknium1]

Summary

hermes update feels slow after the 'draining' line because it was passively waiting on systemd's auto-restart — gated by RestartSec=60 in the unit file. After a voluntary restart, that 60s dead air adds nothing. This PR collapses the post-drain wait from ~60s to ~5s.

Root cause

After SIGUSR1 drain, the gateway exits with code 75. Our unit file has Restart=always + RestartForceExitStatus=75 + RestartSec=60. systemd WILL respawn the unit, but waits RestartSec first — correct behavior for crash-loop protection, wasted time for a user-initiated restart.

Fix

After the drain, call reset-failed + start explicitly. Manual start bypasses RestartSec (it only governs systemd's own auto-restart logic). Takes ~1-3s instead of ~60s.

The RestartSec=60 default stays — still the right crash-loop guard. This only short-circuits the voluntary restart path.

Matches the pattern already used in hermes gateway restart (systemd_restart() in hermes_cli/gateway.py, from PR #20949).

Changes

• hermes_cli/main.py: after _graceful_restart_via_sigusr1 succeeds, issue reset-failed + start + short 10s poll. Falls back to the original passive RestartSec poll only if explicit start fails.
• tests/hermes_cli/test_update_gateway_restart.py: new test_update_bypasses_restartsec_after_graceful_drain — asserts both reset-failed hermes-gateway AND start hermes-gateway (not restart) are issued after a successful graceful drain.

Validation

• New test passes.
• All 9 tests in TestCmdUpdateLaunchdRestart green.
• All 3 tests in TestCmdUpdateResetFailedBeforeRestart green (one is pre-existingly flaky under parallel xdist on main — unrelated).

Before / After

	Before	After
hermes update drain message	'draining (up to 75s)...'	same (drain budget is a separate knob)
Post-drain wait for gateway respawn	~60s (RestartSec)	~1-3s (explicit start)
Crash-loop protection	RestartSec=60 intact	RestartSec=60 intact

[github-actions]

🚨 CRITICAL Supply Chain Risk Detected

This PR contains a pattern that has been used in real supply chain attacks. A maintainer must review the flagged code carefully before merging.

🚨 CRITICAL: Install-hook file added or modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Scanner only fires on high-signal indicators: .pth files, base64+exec/eval combos, subprocess with encoded commands, or install-hook files. Low-signal warnings were removed intentionally — if you're seeing this comment, the finding is worth inspecting.

[github-actions]

🔎 Lint report: fix/update-systemd-restart-delay vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 7822 on HEAD, 7804 on base (🆕 +18)

🆕 New issues (8):

Rule	Count
unresolved-attribute	3
unsupported-operator	3
not-subscriptable	1
invalid-argument-type	1

First entries

tests/agent/test_codex_cloudflare_headers.py:163: [unresolved-attribute] unresolved-attribute: Attribute `get` is not defined on `str & ~AlwaysFalsy`, `int & ~AlwaysFalsy` in union `(Unknown & ~AlwaysFalsy) | (str & ~AlwaysFalsy) | (dict[str, str] & ~AlwaysFalsy) | ... omitted 4 union elements`
tests/run_agent/test_provider_attribution_headers.py:155: [unsupported-operator] unsupported-operator: Operator `not in` is not supported between objects of type `Literal["X-OpenRouter-Cache"]` and `Unknown | str | dict[str, str] | ... omitted 4 union elements`
tests/run_agent/test_provider_attribution_headers.py:90: [unresolved-attribute] unresolved-attribute: Attribute `startswith` is not defined on `dict[str, str]` in union `Unknown | str | Divergent | dict[str, str]`
tests/agent/test_codex_cloudflare_headers.py:181: [unsupported-operator] unsupported-operator: Operator `in` is not supported between objects of type `Literal["originator"]` and `(Unknown & ~AlwaysFalsy) | (str & ~AlwaysFalsy) | (dict[str, str] & ~AlwaysFalsy) | ... omitted 4 union elements`
tests/run_agent/test_provider_attribution_headers.py:156: [unsupported-operator] unsupported-operator: Operator `not in` is not supported between objects of type `Literal["X-OpenRouter-Cache-TTL"]` and `Unknown | str | dict[str, str] | ... omitted 4 union elements`
tests/run_agent/test_provider_attribution_headers.py:154: [not-subscriptable] not-subscriptable: Cannot subscript object of type `int` with no `__getitem__` method
run_agent.py:6651: [invalid-argument-type] invalid-argument-type: Argument to function `_codex_cloudflare_headers` is incorrect: Expected `str`, found `Unknown | str | dict[str, str] | ... omitted 4 union elements`
tests/agent/test_codex_cloudflare_headers.py:163: [unresolved-attribute] unresolved-attribute: Attribute `startswith` is not defined on `dict[str, str]` in union `Unknown | str | Divergent | dict[str, str]`

✅ Fixed issues (2):

Rule	Count
unresolved-attribute	1
invalid-argument-type	1

First entries

tests/agent/test_codex_cloudflare_headers.py:163: [unresolved-attribute] unresolved-attribute: Attribute `get` is not defined on `str & ~AlwaysFalsy` in union `(Unknown & ~AlwaysFalsy) | (str & ~AlwaysFalsy) | (dict[str, str] & ~AlwaysFalsy) | dict[Unknown, Unknown] | Divergent`
run_agent.py:6651: [invalid-argument-type] invalid-argument-type: Argument to function `_codex_cloudflare_headers` is incorrect: Expected `str`, found `Unknown | str | dict[str, str] | dict[Unknown, Unknown] | Divergent`

Unchanged: 4113 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.