Restart Hermes' gateway after updating Hermes

The gateway reads its sandbox rules and loads new dependencies only when it
starts, and hermes update restarts it only for new code. Restart it at the end
of the sandbox update step instead of before hermes update runs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

updates.d/72-sandbox.sh

@@ -12,5 +12,12 @@ run_update() {
     echo "Updating Hermes Agent..."
     "$HOME/.local/bin/hermes" update < /dev/null || status=1
   fi
+
+  # The gateway reads its sandbox rules and loads new dependencies only when it
+  # starts, and Hermes restarts it only for new code
+  if systemctl --user is-active --quiet hermes-gateway.service; then
+    echo "Restarting Hermes' gateway..."
+    systemctl --user restart hermes-gateway.service || status=1
+  fi
   return $status
 }