refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

Completes the de-sidecar cleanup: no live code, test, current doc,
script, or nix file mentions or is named "sidecar" any more. Only the
dated PRD/research docs keep the term as historical record (agreed on
the #385 thread).

- Rename `sidecar_init.py`→`gateway_init.py` was done earlier; this pass
  sweeps the remaining descriptive uses: the egress / git-gate / supervise
  components are the gateway's *daemons*, the shared container is the
  *gateway*, the old per-bottle container was the *companion container*.
- Rename `tests/integration/test_sidecar_bundle_image.py`→`test_gateway_image.py`
  and its class; update `docs/ci.md` + `tests/README.md` for the renamed/
  removed integration tests.
- `SIDECAR_PORTS` shell var in `scripts/firecracker-netpool.sh`→`GATEWAY_PORTS`.

Full unit suite green (bar the pre-existing `/bin/sleep`-missing env
errors in test_gateway_init); docker integration — gateway singleton,
broker, real two-bottle multitenant isolation, and the gateway-image
build — all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_consolidated_compose.py

@@ -19,8 +19,8 @@ class TestConsolidatedAgentCompose(unittest.TestCase):
             plan = type(plan)(**{**vars(plan), "use_runsc": True})  # type: ignore[arg-type]
         return consolidated_agent_compose(plan, gateway_ip=_GW, source_ip=_IP, network=_NET)
 
-    def test_only_agent_service_no_sidecars(self) -> None:
-        # The whole point of consolidation: no per-bottle sidecar bundle.
+    def test_only_agent_service_no_companion_container(self) -> None:
+        # The whole point of consolidation: no per-bottle gateway.
         self.assertEqual(["agent"], list(self._spec()["services"]))
 
     def test_agent_pinned_on_external_gateway_network(self) -> None:
@@ -35,7 +35,7 @@ class TestConsolidatedAgentCompose(unittest.TestCase):
         # git-http + supervise on the gateway must bypass the egress proxy.
         self.assertTrue(any(e.startswith("NO_PROXY=") and _GW in e for e in env))
 
-    def test_no_sidecar_dependency(self) -> None:
+    def test_no_companion_container_dependency(self) -> None:
         self.assertNotIn("depends_on", self._spec()["services"]["agent"])
 
     def test_runsc_runtime_when_enabled(self) -> None: