fix: make installed wheel self-contained + harden install.sh prereqs

Addresses the review on PR #481.

Self-contained wheel (review point 1): the gateway/infra/orchestrator
images build from a context that must hold bot_bottle/, pyproject.toml,
and the root-level Dockerfiles. Modules previously located these by
walking __file__ to the repo root, so an installed wheel (package in
site-packages, no repo root) passed `doctor` but failed `start`.

- Add bot_bottle/resources.py: build_root() returns the repo root in a
  checkout (unchanged) or a staged copy from the wheel's bundled
  _resources/ otherwise; dockerfile()/nix_netpool_module()/
  netpool_script() derive from it.
- setup.py bundles the root Dockerfiles, nix module, netpool script, and
  pyproject.toml into bot_bottle/_resources/ at build; MANIFEST.in ships
  them in the sdist.
- Route every _REPO_ROOT/_REPO_DIR call site (docker/macos launch, macos
  infra, firecracker infra_vm/infra_artifact/setup, orchestrator
  lifecycle/gateway) through resources. Checkout behavior is unchanged.

install.sh prerequisites (review point 2): check for git when installing
a git+ spec, and — before the pip fallback — that pip is usable and the
interpreter isn't externally managed (PEP 668), pointing at pipx.

Tests: test_resources covers checkout + staged-wheel layouts;
test_wheel_install builds the wheel, installs it into an isolated venv,
and asserts `doctor` runs and build_root() yields a valid context.
Running `start` end-to-end still needs a Docker/KVM host (CI).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.py

@@ -0,0 +1,46 @@
+"""Build shim. Project metadata lives in ``pyproject.toml``; this only adds a
+build step that copies the root-level build resources (the Dockerfiles, the
+nix netpool module, the netpool script, and ``pyproject.toml``) into
+``bot_bottle/_resources/`` so an installed wheel is self-contained and can
+build its gateway/infra/orchestrator images without a source checkout.
+
+Kept in sync with ``bot_bottle.resources.BUNDLED_RESOURCES`` — the
+``test_resources`` suite guards against drift between the two lists.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+from setuptools import setup
+from setuptools.command.build_py import build_py
+
+_ROOT = Path(__file__).resolve().parent
+
+# Must match bot_bottle.resources.BUNDLED_RESOURCES (paths relative to root).
+_BUNDLED_RESOURCES = (
+    "pyproject.toml",
+    "Dockerfile.gateway",
+    "Dockerfile.orchestrator",
+    "Dockerfile.orchestrator.fc",
+    "nix/firecracker-netpool.nix",
+    "scripts/firecracker-netpool.sh",
+)
+
+
+class _BundleResources(build_py):
+    """Copy the root-level build resources into the built package tree so they
+    ship inside the wheel under ``bot_bottle/_resources/``."""
+
+    def run(self) -> None:
+        super().run()
+        pkg_resources = Path(self.build_lib) / "bot_bottle" / "_resources"
+        for rel in _BUNDLED_RESOURCES:
+            src = _ROOT / rel
+            dst = pkg_resources / rel
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(src, dst)
+
+
+setup(cmdclass={"build_py": _BundleResources})