Extract the container guard @KoNit-K added to `_cmd_install()` into
`refuses_container_user_scope_install()` and run it on both places that make a
fresh user-scope decision from operator input: the `hermes gateway install` CLI
(exit 1) and the `hermes gateway setup` wizard's default "User service" choice
(`install_linux_gateway_from_setup` now returns `(scope, False)` so the wizard
skips install + start). `ensure_gateway_service()` already refuses in
containers; `gateway migrate` only reinstalls units it recorded from the fleet,
so it is left alone.
Guidance text ported from #112334 (@kokhlo): names the shared-home mechanism and
the duplicate-poller symptom, offers `hermes gateway run` + a container restart
policy, and points systemd containers at
`sudo hermes gateway install --system --run-as-user <user>`. `--system` inside a
container stays untouched (that is why `supports_systemd_services()` returns
True there on purpose). Docs note under Service Management.
Co-authored-by: kokhlo <konstantin.khlopkov93@gmail.com>
c4e8fcda7d