feat(orchestrator): durable launch-broker secret via TrustDomain (#468)

Chunk 2 of the host-control-server stack: close the PRD's **durable
secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap.

- trust_domain.py: two new domains. LAUNCH_BROKER holds the durable
  HS256 key both the orchestrator (signer) and the host control server
  (verifier) share for the broker's launch JWT — a host-canonical key
  file minted 0600 on first use, so a restarted orchestrator re-verifies
  against the same key (re-adoption). HOST_CONTROLLER is the separate
  domain for the controller's own lifecycle endpoints, keyed by a key the
  orchestrator never holds (its lifecycle role is `host`, deliberately
  outside the control-plane ROLES). LaunchBrokerProvisioning is the
  fail-closed seam, mirroring ControlPlaneProvisioning.
- orchestrator_auth.py: ROLE_HOST, outside ROLES so the orchestrator's
  control-plane key can neither mint nor accept it.
- paths.py: key-file + env-var constants for both domains.
- host_server.py / __main__.py: broker_secret() now resolves the durable
  LAUNCH_BROKER key — env-injected for a containerized launcher, else the
  host key file for a host-side dev-harness process — so `--broker http`
  and the host controller "just work" on one host without exporting a
  secret, and stay fail-closed when the root is unwritable.

Tested: domain boundary (host role unmintable by the control plane,
cross-domain tokens don't verify), distinct keys/env vars per domain,
provisioning fail-closed, and broker_secret env/file resolution +
durability. Full unit suite green; pyright clean; pylint 9.90.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/__main__.py

@@ -17,9 +17,10 @@ from pathlib import Path
 
 from .. import log
 from .store.store_manager import StoreManager
+from ..paths import LAUNCH_BROKER_KEY_ENV
 from .broker import StubBroker, SubmitBroker
 from .broker_client import BrokerClient
-from .host_server import BROKER_SECRET_ENV, DEFAULT_PORT, broker_secret_from_env
+from .host_server import DEFAULT_PORT, broker_secret
 from .server import make_server
 from .docker_broker import DockerBroker
 from .store.registry_store import RegistryStore, default_db_path
@@ -57,17 +58,17 @@ def main(argv: list[str] | None = None) -> int:
     # A signing secret ties the orchestrator (signer) to its broker (verifier).
     # 'stub' records launches instead of starting anything; 'docker' runs real
     # containers in-process; 'http' relays signed requests to a separate host
-    # control server, which verifies and launches. For 'stub'/'docker' the
-    # secret is ephemeral (signer and verifier share this process); for 'http'
-    # it must be the SAME secret the host controller holds, so it is read from
-    # the shared env var (the chunk-1 stand-in for out-of-band provisioning).
+    # control server, which verifies and launches. For 'stub'/'docker' the secret
+    # is ephemeral (signer and verifier share this process); for 'http' it must be
+    # the SAME key the host controller holds, so both resolve the durable
+    # launch-broker TrustDomain key (env-injected, or the host key file).
     broker: SubmitBroker
     if args.broker == "http":
-        secret = broker_secret_from_env()
+        secret = broker_secret()
         if secret is None:
             parser.error(
-                f"--broker http requires a shared signing secret in "
-                f"${BROKER_SECRET_ENV} (hex), matching the host control server"
+                f"--broker http requires the launch-broker key (${LAUNCH_BROKER_KEY_ENV}, "
+                "or a writable host root to mint it), matching the host control server"
             )
         broker = BrokerClient(args.host_controller_url)
     else: