refactor(bootstrap): deduplicate runtime resolution for gateway connections

Add connect_for_gateway(name) helper that resolves the container runtime
from stored gateway metadata first, falling back to detect_runtime() with
full error propagation instead of silently defaulting to Docker.

Replace the duplicated inline metadata-detect-fallback blocks in
extract_and_store_pki and gateway_container_logs with the new helper.

Author: maxamillion

crates/openshell-bootstrap/src/docker.rs

@@ -273,6 +273,23 @@ pub(crate) fn connect_local_auto() -> Result<Docker> {
     connect_local(runtime)
 }
 
+/// Connect to the local container runtime for an existing gateway.
+///
+/// Resolution order:
+/// 1. Stored runtime from gateway metadata (if metadata exists)
+/// 2. Auto-detect runtime via `detect_runtime` (propagates error on failure)
+///
+/// This is used by code paths that have a gateway `name` but no `runtime`
+/// in scope. Unlike `connect_local_auto()`, this checks metadata first so
+/// that gateways deployed with a specific runtime reconnect to the same one.
+pub(crate) fn connect_for_gateway(name: &str) -> Result<Docker> {
+    let runtime = match crate::metadata::get_gateway_metadata(name) {
+        Some(m) => m.container_runtime,
+        None => crate::container_runtime::detect_runtime(None)?,
+    };
+    connect_local(runtime)
+}
+
 /// Build a rich, user-friendly error when a container runtime is not reachable.
 fn runtime_not_reachable_error(
     runtime: ContainerRuntime,

crates/openshell-bootstrap/src/lib.rs

@@ -669,12 +669,7 @@ pub async fn extract_and_store_pki(
 ) -> Result<()> {
     let docker = match remote {
         Some(r) => create_ssh_docker_client(r).await?,
-        None => {
-            let runtime = get_gateway_metadata(name)
-                .map(|m| m.container_runtime)
-                .unwrap_or_else(|| detect_runtime(None).unwrap_or(ContainerRuntime::Docker));
-            docker::connect_local(runtime)?
-        }
+        None => docker::connect_for_gateway(name)?,
     };
     let cname = docker::find_gateway_container(&docker, port).await?;
     let bundle = load_existing_pki_bundle(&docker, &cname, constants::KUBECONFIG_PATH)
@@ -717,12 +712,7 @@ pub async fn gateway_container_logs<W: std::io::Write>(
 
     let docker = match remote {
         Some(remote_opts) => create_ssh_docker_client(remote_opts).await?,
-        None => {
-            let runtime = get_gateway_metadata(name)
-                .map(|m| m.container_runtime)
-                .unwrap_or_else(|| detect_runtime(None).unwrap_or(ContainerRuntime::Docker));
-            docker::connect_local(runtime)?
-        }
+        None => docker::connect_for_gateway(name)?,
     };
 
     let container = container_name(name);