Tunnel certDomain/certPem doesn't take effect - gost TLS listener keeps self-signed cert

[yangyang1234asd-cloud]

Describe the bug
设置隧道(Tunnel)的证书字段(certDomain/certPem/certKeyPem)后，Agent 生成的 gost 配置不包含证书，TLS listener 仍使用 gost 自签证书(CN=gost.run)，而不是配置的 Let's Encrypt 证书。

Environment

• Panel: v2.3.272 (Docker)
• Agent: v2.3.272 (Go agent)
• Tunnel: mode=tls, relayMode=chain, forwardxVersion=v1

Steps to reproduce

1. Set tunnel certDomain/certPem/certKeyPem (via API or DB)
2. Restart panel, confirm certDomain saved (tunnels.list returns cert fields)
3. Agent syncs, check /etc/forwardx/runtime/tunnel-gost.json
4. TLS listener only has "type": "tls", no certFile/keyFile/tls sub-object
5. openssl connect to tunnel port shows self-signed CN=gost.run

Expected behavior
Agent should include the configured certificate in gost TLS listener (gost v3 format: tls:{certFile,keyFile} or embedded cert)

Workaround
Manually editing tunnel-gost.json to gost v3 format (listener.tls.certFile/keyFile) makes the cert work (Verification OK), but agent reconciliation overwrites it every 30s.

[poouo]

OK tks！