The gateway reads its sandbox rules and loads new dependencies only when it
starts, and hermes update restarts it only for new code. Restart it at the end
of the sandbox update step instead of before hermes update runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>