fix(infra-build): repair gateway image build so infra artifact can publish

The Firecracker integration + coverage jobs pull a prebuilt infra rootfs
artifact (PRD 0069 Stage 2) versioned by a content hash of the Dockerfiles,
bot_bottle/, and the guest init. Building that artifact (publish_infra ->
docker build Dockerfile.gateway) has been broken since 5ad3449, so the
artifact was never published and the KVM runner's integration test 404'd on
the pull — the failure this branch surfaced once it stopped falsely skipping.

Two build-time bugs, both from 5ad3449, neither exercised since:

- pyproject.toml declared build-backend "setuptools.backends.legacy:build",
  which is not an importable module; `pip install /src/` failed with
  BackendUnavailable. Use the real backend, "setuptools.build_meta"
  (the project has proper [project] metadata + flat-layout autodiscovery).
  Not part of the artifact hash, so this alone doesn't move the version.

- Dockerfile.gateway wrote /app/egress_addon.py before /app existed (the
  mkdir/WORKDIR came later), so the RUN redirect died with exit 2. Move
  WORKDIR /app above the shim write (WORKDIR creates it) and drop the now
  redundant later WORKDIR. This changes the gateway Dockerfile, so the infra
  artifact version moves 3c9e7b23260992db -> 01e6aaa714756fce; the matching
  artifact has been built and published to the generic package registry.

Also add Dockerfile* and pyproject.toml to test.yml's path filters: these
inputs determine what the firecracker jobs build/pull, so a change to them
must re-run the suite (and lets this push trigger a pull_request run).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A9qa3xoavjQScufDfZaXKR

.gitea/workflows/test.yml

@@ -25,12 +25,20 @@ on:
       - '.gitea/workflows/**.yml'
       - 'scripts/**'
       - 'README.md'
+      # The Firecracker infra artifact the integration/coverage jobs pull is
+      # versioned by a content hash of the Dockerfiles (+ bot_bottle/, init);
+      # pyproject.toml drives the in-image package install. Changes here alter
+      # what those jobs build/pull, so they must re-run the suite.
+      - 'Dockerfile*'
+      - 'pyproject.toml'
   pull_request:
     paths:
       - '**.py'
       - '.gitea/workflows/**.yml'
       - 'scripts/**'
       - 'README.md'
+      - 'Dockerfile*'
+      - 'pyproject.toml'
   workflow_dispatch:
 
 jobs: