Refuse before touching anything, and move an old gateway cleanly

The first E2E run of the migration found that the new runtime cannot install its gateway service while the old package's gateway, still running from deleted files, holds the state directory, so that service is stopped first. Removal also takes the unit backups `openclaw update` leaves behind.

Codex's review found the rest: upstream's installer takes over any loaded gateway service, so a gateway running another OpenClaw, a foreign command on PATH or an openclaw shadowing it are refused before anything is set up; root is refused before --check runs the user's wrapper; --check needs the package, since --now would otherwise run pacman where no terminal can ask for a password; and moving a service clears the selectors that would aim the install at another unit.

Co-Authored-By: Codex XHigh <noreply@openai.com>

test/shell.d/remove-ai-test.sh

@@ -245,6 +245,8 @@ fresh_openclaw_home() {
     "$HOME/.local/share/applications" "$HOME/.local/share/icons/hicolor/256x256/apps"
   touch "$HOME/.config/systemd/user/openclaw-gateway.service" \
     "$HOME/.config/systemd/user/openclaw-gateway.service.bak" \
+    "$HOME/.config/systemd/user/openclaw-gateway.service.reconcile-0f1e.bak" \
+    "$HOME/.config/systemd/user/openclaw-gateway.service.reconcile-0f1e.receipt.bak" \
     "$HOME/.config/systemd/user/openclaw-node.service" \
     "$HOME/.openclaw/openclaw.json" \
     "$HOME/.local/share/applications/OpenClaw.desktop" \
@@ -269,6 +271,8 @@ fresh_openclaw_home
 
 for gone in .config/systemd/user/openclaw-gateway.service \
   .config/systemd/user/openclaw-gateway.service.bak \
+  .config/systemd/user/openclaw-gateway.service.reconcile-0f1e.bak \
+  .config/systemd/user/openclaw-gateway.service.reconcile-0f1e.receipt.bak \
   .config/systemd/user/default.target.wants/openclaw-gateway.service \
   .config/systemd/user/openclaw-node.service \
   .config/systemd/user/default.target.wants/openclaw-node.service \