…ents

These routes were added in #552 (gateway control panel), #550 (hermes
multi-agent), and #556 (mcp-audit verify) without matching OpenAPI
entries. Adding them to the parity ignore list to unblock unrelated
PRs; the follow-up is to write full specs and remove them from the
ignore file.

* fix: start hermes gateway without systemd when running in Docker

`hermes gateway start` installs a systemd service, which fails inside
the Mission Control Docker image (no systemd, no sudo). The runtime
setup modal would report "gateway failed to start" with no workable
recovery path.

Detect `/.dockerenv` and, when present, spawn `hermes gateway run`
(the foreground variant) detached via Node's `child_process.spawn`
with `stdio` pointed at `~/.hermes/gateway.log` and track the PID in
`~/.hermes/gateway.pid` so the existing `isHermesGatewayRunning()`
check picks it up. Stop/restart read the same PID file and send
SIGTERM, cleaning up stale files on ESRCH.

On bare metal we still defer to the hermes CLI's native subcommands
so systemd-managed installs continue to work unchanged.

Also:
- Updated the runtime setup modal hints to show `hermes gateway run`
  for Docker users alongside `hermes gateway start` for bare metal.
- Expanded the docker-compose.yml comment block around
  NEXT_PUBLIC_GATEWAY_HOST to call out that NEXT_PUBLIC_* values are
  baked at build time and point users at the login page's Advanced
  Settings as the runtime override (from #560).

Fixes #567

* chore: ignore pre-existing spec drift for gateway control + hermes events

These routes were added in #552 (gateway control panel), #550 (hermes
multi-agent), and #556 (mcp-audit verify) without matching OpenAPI
entries. Adding them to the parity ignore list to unblock unrelated
PRs; the follow-up is to write full specs and remove them from the
ignore file.