no-mistakes(review): Fix B4.5 grep to literal no-key-required and clarify infisical_present false restart action

zulip-health.prose.md

@@ -303,7 +303,7 @@ Check gateway logs for `no-key-required` failure pattern (indicates the
 cli_agent_setup_mixin.py patch is missing):
 
 ```bash
-ssh root@<CT> "grep -c 'no-k.*ired' /root/.hermes/logs/gateway.log 2>/dev/null || echo 0"
+ssh root@<CT> "grep -c 'no-key-required' /root/.hermes/logs/gateway.log 2>/dev/null || echo 0"
 ```
 
 If > 0 → flag `no_key_required_count: <count>`, note as degraded — provider
@@ -353,7 +353,7 @@ wraps it.
 | No heartbeat in 10min | Restart gateway |
 | `Failed to finalize` > 50% | Check PATCH API, Zulip server |
 | Response empty/short | Check A2A endpoint / LiteLLM model |
-| `infisical_present: false` | Flag as degraded — log and alert, do NOT restart (no infisical = no key on restart) |
+| `infisical_present: false` | Flag as degraded — log and alert; do NOT auto-restart via the standard command (it cannot inject the key without infisical). Operator may use the Infisical-missing fallback restart below. |
 | `config_valid: false` | Flag as degraded — alert user, gateway running on stale config |
 | Stale pid/lock files detected | Clean files before restart |
 | `no_key_required_count > 0` | Flag as degraded — check LITELLM_API_KEY injection |