feat(firecracker): split orchestrator and gateway into separate VMs (PRD 0070)

Now that #469 got the DB off the data plane, the Firecracker infra runs as
two microVMs instead of one — mirroring the docker/macos plane split:

  * orchestrator VM (ORCH_IFACE) — control plane + buildah image builds; sole
    DB opener; host-seeded signing key. No gateway daemons.
  * gateway VM (new GW_IFACE) — egress / git-http / supervise data plane;
    mitmproxy CA + a host-minted `gateway` JWT (never the key). Reaches the
    orchestrator only over the one nft forward rule its link allows.

Both boot the SAME shared infra rootfs; a `bb_role=` kernel-cmdline arg
selects which plane a VM's PID-1 init starts, so there is still one published
artifact. The gateway learns the orchestrator's address via `bb_orch=` on the
cmdline (no IP baked into the artifact).

Isolation is nearly free: agents were already nft-dropped except the DNAT'd
gateway ports, so re-pointing that single DNAT rule at the gateway VM
(`dnat to gw_guest`) severs every agent's L3 route to the control plane. The
only added nft is the second infra link's mirror block (masquerade egress +
forward accept, which subsumes gateway->orchestrator) in the shared shell
script and the NixOS module.

netpool gains GW_IFACE + gw_slot() (the /31 above the orch link);
firecracker_vm.boot gains extra_boot_args for the role cmdline; infra_vm
ensure_running() boots + adopts the pair (orchestrator first, then the gateway
that resolves policy against it) and returns an InfraEndpoint mirroring the
docker/macos shape. Builds stay in the orchestrator (PRD 0070 v1); the gateway
is the slim unit.

Unit-tested (test_firecracker_infra_vm rewritten for two VMs; gw_slot helper
test added); the KVM boot / L3-isolation checks are validated on a Firecracker
host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/firecracker/netpool.defaults.env

@@ -15,11 +15,19 @@ BOT_BOTTLE_FC_POOL_SIZE=8
 BOT_BOTTLE_FC_IP_BASE=10.243.0.0
 BOT_BOTTLE_FC_IFACE_PREFIX=bbfc
 BOT_BOTTLE_FC_NFT_TABLE=bot_bottle_fc
-# The orchestrator/gateway VM's own TAP — a dedicated link OUTSIDE the
-# bbfc* agent pool. Unlike agent VMs (which reach only their gateway),
-# the orchestrator is trusted infra that needs real NAT'd internet
-# egress: to FROM-pull + apt/npm during in-VM agent-image builds
-# (buildah) and to forward agent egress upstream (Stage B gateway). Its
+# The orchestrator VM's own TAP — a dedicated link OUTSIDE the bbfc*
+# agent pool. Unlike agent VMs (which reach only their gateway), the
+# orchestrator is trusted infra that needs real NAT'd internet egress:
+# to FROM-pull + apt/npm during in-VM agent-image builds (buildah). Its
 # /31 is the top of the IP_BASE /16 (host x.y.255.0, guest x.y.255.1),
 # clear of the pool near the bottom of the block.
 BOT_BOTTLE_FC_ORCH_IFACE=bborch0
+# The gateway (data-plane) VM's own TAP — the second infra link, split
+# from the orchestrator now that #469 got the DB off the data plane (PRD
+# 0070 "Separating the planes"). It mirrors the orchestrator link: NAT'd
+# internet egress (the gateway forwards agent egress upstream) plus a
+# forward path to reach the orchestrator's control plane. Its /31 is the
+# next one above the orchestrator link (host x.y.255.2, guest x.y.255.3).
+# Agents DNAT their gateway-port traffic here (not to the orchestrator),
+# so a breached agent has no L3 route to the control plane.
+BOT_BOTTLE_FC_GW_IFACE=bbgw0