feat(orchestrator): durable launch-broker secret via TrustDomain (#468)

Chunk 2 of the host-control-server stack: close the PRD's **durable
secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap.

- trust_domain.py: two new domains. LAUNCH_BROKER holds the durable
  HS256 key both the orchestrator (signer) and the host control server
  (verifier) share for the broker's launch JWT — a host-canonical key
  file minted 0600 on first use, so a restarted orchestrator re-verifies
  against the same key. HOST_CONTROLLER is the separate domain for the
  controller's own lifecycle endpoints, keyed by a key the orchestrator
  never holds (its role is `host`, deliberately outside control-plane
  ROLES). LaunchBrokerProvisioning is the fail-closed seam.
- orchestrator_auth.py: ROLE_HOST, outside ROLES.
- paths.py: key-file + env-var constants for both domains.

Key resolution is split by owner (addresses codex review on #497):
broker_secret(allow_host_file=...) — the host controller / dev-harness
(True) may mint/read the durable host key file it owns; the GUEST
orchestrator (--broker http, default False) must be *injected* the key
and fails closed if it isn't. A guest that fell back to the host file
would mint a process-local key unrelated to the host controller's, so
startup would succeed but every launch would 401 — this prevents that
silent divergence.

Tested: domain boundary + separation, provisioning fail-closed, and
broker_secret env-only (guest) vs host-file (host) resolution. pyright
clean; pylint 9.86.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_main.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 from bot_bottle.orchestrator.__main__ import main
+from bot_bottle.paths import LAUNCH_BROKER_KEY_ENV
 
 
 def _fake_server() -> MagicMock:
@@ -32,7 +33,7 @@ class TestMain(unittest.TestCase):
             with patch("bot_bottle.orchestrator.__main__.make_server", return_value=fake), \
                     patch.dict("os.environ", env or {}, clear=False):
                 if env is None:
-                    os.environ.pop("BOT_BOTTLE_BROKER_SECRET", None)
+                    os.environ.pop(LAUNCH_BROKER_KEY_ENV, None)
                 rc = main(argv)
         return rc, fake
 
@@ -46,16 +47,18 @@ class TestMain(unittest.TestCase):
         rc, _ = self._run("docker")
         self.assertEqual(0, rc)
 
-    def test_http_broker_with_secret_serves(self) -> None:
+    def test_http_broker_with_injected_key_serves(self) -> None:
+        # The guest orchestrator takes the launch-broker key by injection.
         rc, _ = self._run(
-            "http", env={"BOT_BOTTLE_BROKER_SECRET": secrets.token_bytes(16).hex()})
+            "http", env={LAUNCH_BROKER_KEY_ENV: secrets.token_urlsafe(16)})
         self.assertEqual(0, rc)
 
-    def test_http_broker_without_secret_exits(self) -> None:
-        # Fail-closed: --broker http with no shared secret is a usage error.
+    def test_http_broker_without_injected_key_exits(self) -> None:
+        # Fail-closed: no host-file fallback for the guest, so a missing injected
+        # key is a usage error rather than a silently-minted divergent key.
         with tempfile.TemporaryDirectory() as d:
             with patch.dict("os.environ", {}, clear=False):
-                os.environ.pop("BOT_BOTTLE_BROKER_SECRET", None)
+                os.environ.pop(LAUNCH_BROKER_KEY_ENV, None)
                 with self.assertRaises(SystemExit):
                     main(["--db", str(Path(d) / "r.db"), "--broker", "http"])