refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

Completes the de-sidecar cleanup: no live code, test, current doc,
script, or nix file mentions or is named "sidecar" any more. Only the
dated PRD/research docs keep the term as historical record (agreed on
the #385 thread).

- Rename `sidecar_init.py`→`gateway_init.py` was done earlier; this pass
  sweeps the remaining descriptive uses: the egress / git-gate / supervise
  components are the gateway's *daemons*, the shared container is the
  *gateway*, the old per-bottle container was the *companion container*.
- Rename `tests/integration/test_sidecar_bundle_image.py`→`test_gateway_image.py`
  and its class; update `docs/ci.md` + `tests/README.md` for the renamed/
  removed integration tests.
- `SIDECAR_PORTS` shell var in `scripts/firecracker-netpool.sh`→`GATEWAY_PORTS`.

Full unit suite green (bar the pre-existing `/bin/sleep`-missing env
errors in test_gateway_init); docker integration — gateway singleton,
broker, real two-bottle multitenant isolation, and the gateway-image
build — all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/backend/macos_container/__init__.py

@@ -2,7 +2,7 @@
 
 Selectable via `BOT_BOTTLE_BACKEND=macos-container`. This package owns
 the Apple `container` CLI integration; launch remains gated until the
-sidecar network enforcement shape is implemented.
+gateway network enforcement shape is implemented.
 """
 
 from .backend import MacosContainerBottleBackend

bot_bottle/backend/macos_container/egress_apply.py

@@ -1,7 +1,7 @@
 """Host-side egress route-apply for the macos-container backend.
 
 The per-bottle companion container this used to signal (`container kill
---signal HUP <container>`) was removed in the de-sidecar cleanup (#385),
+--signal HUP <container>`) was removed in the companion-container removal (#385),
 along with the disabled macOS launch path. Fails closed until the macOS
 backend grows the consolidated gateway.
 """

bot_bottle/backend/macos_container/enumerate.py

@@ -1,6 +1,6 @@
 """Active-agent enumeration for the macOS Apple Container backend.
 
-The backend is disabled during the de-sidecar cleanup (#385) — it can't
+The backend is disabled during the companion-container removal (#385) — it can't
 launch bottles, so there are none to enumerate. Enumeration returns when
 the backend grows the consolidated gateway.
 """

bot_bottle/backend/macos_container/launch.py

@@ -3,7 +3,7 @@
 This backend launched a per-bottle companion container (the egress /
 git-gate / supervise data plane) alongside the agent container, with the
 agent's proxy env pointed at the companion's host-only IP. That
-per-bottle-companion architecture was removed in the de-sidecar cleanup;
+per-bottle-companion architecture was removed in the companion-container removal;
 the macOS backend will be re-enabled once it grows the consolidated
 per-host gateway the docker backend already uses.