de93cb05fd
`launchctl kickstart system/<label>` needs root. When a LaunchDaemon-supervised backend does not come back and `hermes update` runs as a regular user, the manual hint now reads `sudo launchctl kickstart -k system/<label>`, so the operator gets a command that works from the shell they are in. LaunchAgent (gui/user domain) hints are unchanged.