fix: complete deployment release gates

tools/thothctl/internal/pi/update.go

@@ -526,8 +526,14 @@ func ensureMaintenance(ctx context.Context, runner Runner) error {
 }
 
 func activeSessions(ctx context.Context, runner Runner) (bool, error) {
+	scope := "all"
+	if scoped, ok := runner.(interface{ SessionInventoryScope() string }); ok {
+		if requested := scoped.SessionInventoryScope(); requested == "mine" || requested == "all" {
+			scope = requested
+		}
+	}
 	args := append([]string{"exec", "-T", "core", "curl", "-fsS"}, internalIdentityHeaders...)
-	args = append(args, "http://127.0.0.1:8787/sessions?scope=all")
+	args = append(args, "http://127.0.0.1:8787/sessions?scope="+scope)
 	result, err := runCompose(ctx, runner, args...)
 	if err != nil {
 		return false, commandError("active-session check", result, err)

tools/thothctl/internal/pi/update_test.go

@@ -30,6 +30,30 @@ func TestActiveSessionsParsesAuthenticatedBackendBareArrayFixture(t *testing.T)
 	}
 }
 
+type scopedSessionRunner struct {
+	calls []string
+	scope string
+}
+
+func (r *scopedSessionRunner) Run(_ context.Context, args []string, _ io.Reader) (compose.Result, error) {
+	r.calls = append(r.calls, strings.Join(args, " "))
+	return compose.Result{Stdout: "[]"}, nil
+}
+
+func (r *scopedSessionRunner) SessionInventoryScope() string { return r.scope }
+
+func TestActiveSessionsUsesInstallationScopedInventory(t *testing.T) {
+	for _, scope := range []string{"mine", "all"} {
+		runner := &scopedSessionRunner{scope: scope}
+		if active, err := activeSessions(context.Background(), runner); err != nil || active {
+			t.Fatalf("activeSessions(%s) = %t, %v; want false, nil", scope, active, err)
+		}
+		if len(runner.calls) != 1 || !strings.Contains(runner.calls[0], "/sessions?scope="+scope) {
+			t.Fatalf("activeSessions(%s) call = %v; want installation-scoped inventory", scope, runner.calls)
+		}
+	}
+}
+
 func TestUpdateBuildsPinnedVersionRecreatesOnlyCoreAndPersistsRecoveryState(t *testing.T) {
 	fake := newFakeRunner()
 	dir := t.TempDir()