feat(orchestrator): durable launch-broker secret via TrustDomain (#468)

Chunk 2 of the host-control-server stack: close the PRD's **durable
secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap.

- trust_domain.py: two new domains. LAUNCH_BROKER holds the durable
  HS256 key both the orchestrator (signer) and the host control server
  (verifier) share for the broker's launch JWT — a host-canonical key
  file minted 0600 on first use, so a restarted orchestrator re-verifies
  against the same key. HOST_CONTROLLER is the separate domain for the
  controller's own lifecycle endpoints, keyed by a key the orchestrator
  never holds (its role is `host`, deliberately outside control-plane
  ROLES). LaunchBrokerProvisioning is the fail-closed seam.
- orchestrator_auth.py: ROLE_HOST, outside ROLES.
- paths.py: key-file + env-var constants for both domains.

Key resolution is split by owner (addresses codex review on #497):
broker_secret(allow_host_file=...) — the host controller / dev-harness
(True) may mint/read the durable host key file it owns; the GUEST
orchestrator (--broker http, default False) must be *injected* the key
and fails closed if it isn't. A guest that fell back to the host file
would mint a process-local key unrelated to the host controller's, so
startup would succeed but every launch would 401 — this prevents that
silent divergence.

Tested: domain boundary + separation, provisioning fail-closed, and
broker_secret env-only (guest) vs host-file (host) resolution. pyright
clean; pylint 9.86.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_host_server.py

@@ -9,7 +9,9 @@ from __future__ import annotations
 
 import io
 import json
+import os
 import secrets
+import tempfile
 import threading
 import unittest
 import urllib.error
@@ -28,11 +30,12 @@ from bot_bottle.orchestrator.host_server import (
     MAX_BODY_BYTES,
     Handler,
     HostControlServer,
-    broker_secret_from_env,
+    broker_secret,
     dispatch,
     main,
     make_host_server,
 )
+from bot_bottle.paths import LAUNCH_BROKER_KEY_ENV
 
 
 def _body(obj: object) -> bytes:
@@ -124,16 +127,34 @@ class TestDispatch(unittest.TestCase):
         self.assertEqual(200, status)
 
 
-class TestBrokerSecretFromEnv(unittest.TestCase):
-    def test_reads_hex_secret(self) -> None:
-        s = secrets.token_bytes(16)
-        self.assertEqual(s, broker_secret_from_env({"BOT_BOTTLE_BROKER_SECRET": s.hex()}))
+class TestBrokerSecret(unittest.TestCase):
+    """The durable launch-broker key (#468/#476): prefer the env-injected key,
+    else the durable host key file, so signer and verifier resolve the same one."""
 
-    def test_unset_is_none(self) -> None:
-        self.assertIsNone(broker_secret_from_env({}))
+    def test_reads_injected_key_from_env(self) -> None:
+        # The injected key is honoured regardless of allow_host_file — both the
+        # host controller and the guest orchestrator take an injected key.
+        self.assertEqual(
+            b"injected-key", broker_secret({LAUNCH_BROKER_KEY_ENV: "injected-key"}))
+        self.assertEqual(
+            b"injected-key",
+            broker_secret({LAUNCH_BROKER_KEY_ENV: "injected-key"}, allow_host_file=True))
 
-    def test_invalid_hex_is_none(self) -> None:
-        self.assertIsNone(broker_secret_from_env({"BOT_BOTTLE_BROKER_SECRET": "not-hex"}))
+    def test_guest_without_injection_fails_closed(self) -> None:
+        # The default (guest orchestrator): no env key and NO host-file fallback,
+        # so it returns None rather than mint a divergent process-local key.
+        self.assertIsNone(broker_secret({}))
+
+    def test_host_side_falls_back_to_the_durable_key_file(self) -> None:
+        # allow_host_file=True (host controller / dev-harness): mint/read the
+        # durable host key file, the same key on every call (restart re-adoption).
+        with tempfile.TemporaryDirectory() as root:
+            with patch.dict("os.environ", {"BOT_BOTTLE_ROOT": root}, clear=False):
+                os.environ.pop(LAUNCH_BROKER_KEY_ENV, None)
+                first = broker_secret(allow_host_file=True)
+                second = broker_secret(allow_host_file=True)
+        self.assertTrue(first)
+        self.assertEqual(first, second)
 
 
 class TestSeamRoundTrip(unittest.TestCase):
@@ -258,7 +279,7 @@ class TestServeUnit(unittest.TestCase):
 
 class TestMain(unittest.TestCase):
     def test_fail_closed_without_secret(self) -> None:
-        with patch("bot_bottle.orchestrator.host_server.broker_secret_from_env",
+        with patch("bot_bottle.orchestrator.host_server.broker_secret",
                    return_value=None):
             self.assertEqual(2, main(["--port", "0"]))
 
@@ -266,7 +287,7 @@ class TestMain(unittest.TestCase):
         fake = MagicMock()
         fake.server_address = ("127.0.0.1", 0)
         fake.serve_forever.side_effect = KeyboardInterrupt
-        with patch("bot_bottle.orchestrator.host_server.broker_secret_from_env",
+        with patch("bot_bottle.orchestrator.host_server.broker_secret",
                    return_value=b"k"), \
              patch("bot_bottle.orchestrator.host_server.make_host_server",
                    return_value=fake):