fix(package): allow openshell group to read client TLS key

The deb postinst installed the client mTLS key at
/etc/openshell/gateways/default/mtls/tls.key as 0600 openshell:openshell,
which made it unreadable to any human user. Group membership in
'openshell' had no effect because the group bits were ---.

Switch the client key to 0640 so members of the openshell group can
authenticate to the local gateway (matching the docker.sock 0660
root:docker pattern). The server-side key under /etc/openshell/gateway/
remains 0600 — only the gateway daemon needs it.

Also extend install-dev.sh to print group-setup instructions and an
admin-equivalence warning, mirroring how get.docker.com handles the
docker group.

Author: drew

install-dev.sh

@@ -257,6 +257,20 @@ print_next_steps() {
 
   info "the packaged gateway is registered as the system-wide default"
   info "check it with: openshell status"
+
+  _target_user="${SUDO_USER:-$USER}"
+  if [ -n "$_target_user" ] && [ "$_target_user" != "root" ]; then
+    if ! id -nG "$_target_user" 2>/dev/null | tr ' ' '\n' | grep -qx openshell; then
+      info ""
+      info "the gateway's mTLS client key is owned by the 'openshell' group"
+      info "to run 'openshell status' as ${_target_user}, add yourself to the group:"
+      info "  sudo usermod -aG openshell ${_target_user}"
+      info "  newgrp openshell    # or log out and back in"
+      info ""
+      info "WARNING: members of the 'openshell' group can authenticate to the"
+      info "gateway as admin. Only add trusted users."
+    fi
+  fi
 }
 
 # ---------------------------------------------------------------------------

tasks/scripts/package-deb.sh

@@ -328,7 +328,7 @@ EXT
 
   install -o root -g root -m 0644 "$tmpdir/ca.crt" "$client_mtls_dir/ca.crt"
   install -o root -g root -m 0644 "$tmpdir/client.crt" "$client_mtls_dir/tls.crt"
-  install -o openshell -g openshell -m 0600 "$tmpdir/client.key" "$client_mtls_dir/tls.key"
+  install -o openshell -g openshell -m 0640 "$tmpdir/client.key" "$client_mtls_dir/tls.key"
 
   rm -rf "$tmpdir"
   trap - EXIT HUP INT TERM
@@ -339,7 +339,7 @@ else
   chown root:root "$client_mtls_dir/ca.crt" "$client_mtls_dir/tls.crt"
   chmod 0644 "$client_mtls_dir/ca.crt" "$client_mtls_dir/tls.crt"
   chown openshell:openshell "$client_mtls_dir/tls.key"
-  chmod 0600 "$client_mtls_dir/tls.key"
+  chmod 0640 "$client_mtls_dir/tls.key"
 fi
 
 if [ "$1" = "configure" ] && [ -d /run/systemd/system ]; then