gl: quickstart and init silently regenerate an unreadable identity, orphaning the agent DID

[euxaristia]

Summary

gl quickstart and gl init treat any load_keypair_from_dir failure as "no identity" and regenerate: crates/gl/src/quickstart.rs:62-65 ("Identity file exists but is unreadable. Regenerating...") and crates/gl/src/init.rs:69-74, with generate_identity unconditionally fs::write-ing the new PEM over the old file (init.rs:240, :245). gl identity new itself demands confirmation or --force before overwriting (crates/gl/src/identity.rs:114); these two paths bypass that guard.

Impact

A corrupted PEM (non-atomic write, disk fault) or a transient read failure (Windows file lock from AV/backup) silently replaces the agent's keypair with a fresh one. init then registers the NEW DID and creates a new public repo, silently orphaning the old identity: repos, escrow, and trust links become unreachable. Local data loss with real-world triggers.

Remediation

1. On an unreadable existing identity, require explicit confirmation (or --force) before regenerating, and write the old file to a backup path first.
2. Make identity writes atomic (temp file + rename).

Proposed labels: kind:bug, crate:gl, subsystem:identity.

[beardthelion]

Severity call: high, not critical.

What keeps it below critical is who absorbs the loss and what firing takes. The criticals on this tracker are either remotely exploitable by an outside party (#322, #323, #378) or silently destroy another party's data in normal operation (#283: a later writer's push reports success while its objects are gone). This one needs a fault precondition, the identity file already failing to load, plus the operator running quickstart or init, and the harm lands on that operator's own identity rather than on other users or the network.

It stays high rather than medium because the loss is irreversible once it fires: an overwritten PEM cannot be re-derived, so the DID, its repos, escrow, and trust links are orphaned with no recovery path, and the trigger (a corrupt file or a transient read failure, e.g. an AV or backup lock) is a plausible real-world condition rather than an exotic one.