Guest/gate principal collision: safe here, unguarded for self-hosters on a 2-label gate domain

open   by a73x

Labels: backlog

From the pre-launch security audit (finding GATE-1). VERIFIED SAFE on this deployment;
kept open for the self-hoster. Ranked #6 of the outstanding set.

**Status here: not exploitable.** The production gate principal was extracted black-box
(`gate.eitri.sh`, three labels), and guest principals can only ever carry exactly one dot
(the RFC1123 name regex is anchored and dot-free, and the connect name is `<tenant>.<name>`).
So a guest principal cannot collide with this gate's identity.

**Why it stays open.** eitri ships self-hosting docs. An operator who picks a TWO-label
gate domain gets a gate identity a guest principal could forge, with no warning at boot.

**Fixes.** Cheap: a boot-time shape check that refuses a gate domain whose label count
could collide with the guest principal namespace. Real: namespace guest principals so a
collision is structurally impossible regardless of the operator's gate domain.