bug: gateway add silently overwrites certificates when shadowing system-provisioned gateway

[sabre1041]

Agent Diagnostic

• Skills loaded: create-github-issue
• OpenShell version tested: v0.0.91 (latest tag on main)
• Latest release checked: v0.0.91 — no related fixes in changelog or commit history
• Known fixes reviewed: git log --grep for store_pki_bundle, gateway add.*cert, mtls.*overwrite found no relevant patches
• Possible duplicates reviewed: searched open issues for "gateway add certificate overwrite" and "store_pki_bundle" — no matches. fix: improve macOS gateway configuration bootstrap #1372 is related to macOS gateway bootstrap but covers a different flow.
• Findings: The duplicate-name guard in gateway_add() explicitly allows GatewayMetadataSource::System to fall through without warning. store_pki_bundle then unconditionally replaces any existing certificate material at the user gateway path.
• Remaining reason for filing: No guard or confirmation exists for this code path; certificates are silently overwritten.

Description

Actual behavior: Running openshell gateway add --local <name> when a system-provisioned gateway already exists silently creates a user-level shadow and overwrites any existing mTLS certificate material without warning or confirmation.

The duplicate-name guard in crates/openshell-cli/src/run.rs (lines 941–952) handles three cases:

match gateway_metadata_source(name)? {
    Some(GatewayMetadataSource::User) => {
        return Err(miette::miette!(
            "Gateway '{}' already exists.\n\
             Remove it first with: openshell gateway remove {}\n\
             Or choose a different name with: --name <name>",
            name, name,
        ));
    }
    Some(GatewayMetadataSource::System) | None => {}
}

• User → blocked with an error (correct)
• System → silently falls through (problematic)
• None → silently falls through (correct, no existing gateway)

When the System arm falls through, import_local_package_mtls_bundle calls store_pki_bundle (crates/openshell-bootstrap/src/mtls.rs, lines 15–78), which unconditionally replaces the target mtls/ directory — backing up the old certs, writing the new ones, then deleting the backup.

Expected behavior: When shadowing a system-provisioned gateway, the CLI should warn the user and require explicit consent — either an interactive confirmation prompt or a --force flag — before overwriting certificate material.

Reproduction Steps

1. Install OpenShell via a package manager so that a system gateway is provisioned under /etc/openshell/gateways/<name>/
2. Run openshell gateway add --local <name> using the same gateway name
3. Observe that user-level certs are written under ~/.config/openshell/gateways/<name>/mtls/ with no warning
4. Run the same command again — this time it is blocked because the user-level entry now exists

Environment

• OS: macOS (Darwin 25.5.0), also affects Linux
• OpenShell: v0.0.91
• Latest release checked: yes — no related fixes found
• Possible duplicates checked: yes — no matches

Proposed Fix

Change the Some(GatewayMetadataSource::System) arm in the gateway_add guard to warn the user that they are about to shadow an installer-provisioned gateway and require confirmation or a --force flag to proceed. The None arm (no existing gateway) should remain unchanged.

store_pki_bundle itself should stay unconditional — it is a low-level storage primitive and the "should we proceed?" decision belongs in the CLI command layer.