fix(install): don't ask the gateway install questions twice

The setup stage installs the gateway service through
ensure_gateway_service. On Windows that asks the start-now, Scheduled
Task and UAC questions. The gateway stage then ran `hermes gateway
install`, which asked them all again.

`gateway install --if-missing` does nothing when a service is already
installed. Both installers' gateway stages use it, so they ask only
when setup did not install the service.

hermes_cli/gateway.py

@@ -5091,6 +5091,9 @@ def _cmd_install(args):
     if is_managed():
         managed_error("install gateway service")
         return
+    if getattr(args, "if_missing", False) and _is_service_installed():
+        print("✓ Gateway service already installed")
+        return
     force = getattr(args, "force", False)
     # `--force` doubles as the reinstall flag here; a served profile's unit would only ever exit 78.
     _guard_named_profile_under_multiplexer(force=force)

hermes_cli/subcommands/gateway.py

@@ -131,6 +131,8 @@ def build_gateway_parser(
         help="Enable the service to start automatically on login/boot")
     gateway_install.add_argument("--no-start-on-login", dest="start_on_login", action="store_false",
         help="Do not enable the service to start on login/boot")
+    _flag(gateway_install, "--if-missing", dest="if_missing",
+        help="Do nothing when a gateway service is already installed")
     _flag(gateway_install, "--elevated-handoff", dest="elevated_handoff", help=argparse.SUPPRESS)
 
     gateway_uninstall = gateway_subparsers.add_parser("uninstall", help="Uninstall gateway service")

scripts/install.ps1

@@ -1056,7 +1056,8 @@ function Stage-Setup {
 
 function Stage-Gateway {
     if ($NonInteractive) { return }
-    Invoke-InstalledHermes @('gateway', 'install')
+    # Setup installs the service when it handles the gateway; ask only if it did not.
+    Invoke-InstalledHermes @('gateway', 'install', '--if-missing')
 }
 
 function Stage-Desktop {

scripts/install.sh

@@ -714,7 +714,8 @@ stage_gateway() {
         log "gateway setup skipped (no terminal); run 'hermes gateway install' after install"
         return 0
     fi
-    "$INSTALL_DIR/.hermes/bin/hermes" gateway install </dev/tty || fail "gateway installation failed"
+    # Setup installs the service when it handles the gateway; ask only if it did not.
+    "$INSTALL_DIR/.hermes/bin/hermes" gateway install --if-missing </dev/tty || fail "gateway installation failed"
 }
 
 stage_complete() {

tests/hermes_cli/test_gateway.py

@@ -1057,3 +1057,20 @@ def test_service_commands_refuse_on_sealed_apt_termux(
     assert exc.value.code == 1
     out = capsys.readouterr().out
     assert "Termux" in out
+
+
+@pytest.mark.parametrize("installed", [True, False])
+def test_install_if_missing_only_installs_when_no_service_exists(monkeypatch, installed):
+    """The installer's gateway stage runs after setup, which may have installed
+    the service already. --if-missing must not ask the install questions again."""
+    installs = []
+    monkeypatch.setattr(gateway, "is_managed", lambda: False)
+    monkeypatch.setattr(gateway, "_is_service_installed", lambda: installed)
+    monkeypatch.setattr(gateway, "_guard_named_profile_under_multiplexer", lambda force: None)
+    monkeypatch.setattr(gateway, "_service_mgmt_blocked", lambda: False)
+    monkeypatch.setattr(gateway, "_service_backend", lambda: "launchd")
+    monkeypatch.setattr(gateway, "launchd_install", lambda force, start_now: installs.append(force))
+
+    gateway._cmd_install(SimpleNamespace(if_missing=True, force=False, system=False, run_as_user=None))
+
+    assert installs == ([] if installed else [False])

tests/scripts/test_install_sh_launch_handoff.py

@@ -31,7 +31,7 @@ def _with_controlling_terminal(tty_path: str):
 
 
 @pytest.mark.platforms('posix')
-@pytest.mark.parametrize('stage, expected', [('setup', ['setup']), ('gateway', ['gateway', 'install'])])
+@pytest.mark.parametrize('stage, expected', [('setup', ['setup']), ('gateway', ['gateway', 'install', '--if-missing'])])
 def test_installer_post_pm_stages(tmp_path: Path, stage: str, expected: list[str]) -> None:
     install = tmp_path / 'source tree'
     calls = tmp_path / 'calls.json'