`portless trust` asks for authorization again when the CA is already trusted

Written by an AI agent (Claude) on behalf of @jasonkuhrt.

portless trust adds the CA again even when the system already trusts it, so every run asks for authorization: a Keychain dialog on macOS, a sudo password on Linux. Anything that runs it to make sure the CA is trusted prompts every time: a setup script, a dev environment's bootstrap, a tool that wraps Portless. We run it at the start of each dev session, before services use the CA, and every start prompts.

proxy start already checks first: it calls trustCA only when !isCATrusted(stateDir) (cli.ts#L3487). handleTrust calls it unconditionally (cli.ts#L2153):

• macOS: security add-trusted-cert into the login keychain (certs.ts#L1059), which asks for authorization on every call.
• Linux: a normal user can't write the system CA directory (certs.ts#L1071), so it fails with EACCES and re-runs under sudo (cli.ts#L2164).

Fix

Return early from handleTrust when the system store already trusts the CA. That check should skip isCATrusted's marker fast path (certs.ts#L585-L590): portless trust is also how a user repairs trust after deleting the CA from the keychain, and the marker still matches then.

// handleTrust, before trustCA(dir)
if (isCATrusted(dir, { useMarker: false })) {
  console.log(colors.green("Local CA is already trusted."));
  return;
}

Happy to open the PR.