feat(control-plane): role-scoped signed tokens so the gateway can't drive operator routes

Review follow-up on #469: the data plane held the same control-plane secret
that authorizes every route, so a compromised egress/git-gate could queue a
supervise proposal AND approve it (or rewrite policy, read injected tokens) —
the (source_ip, identity_token) checks attribute the *bottle*, not the caller.

Replace the single shared bearer secret with role-scoped, HMAC-signed tokens
(compact HS256 JWTs, stdlib-only — no new dependency):

  * new `control_auth` mints/verifies `{role}` tokens; roles are `gateway`
    (data plane) and `cli` (host operator/launcher).
  * the orchestrator holds only the signing *key* and verifies; `dispatch`
    gates each route by role — `gateway` reaches /resolve + /supervise/
    {propose,poll}, everything else is `cli`-only (401 unauthenticated,
    403 wrong role).
  * the gateway is handed a pre-minted `gateway` token it cannot rewrite into
    `cli`; the host CLI mints its own `cli` token from the host key.
  * `gateway_init` scopes the signing key to the orchestrator process and the
    gateway token to the data-plane daemons, so even in the combined infra
    container a compromised data-plane daemon never sees the key.

Launchers (docker gateway + infra, macOS infra) inject the minted token(s);
Firecracker stays open behind its nft boundary. Open mode (no key) still grants
full `cli` access — the fail-visible fallback for tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/policy_resolver.py

@@ -34,21 +34,22 @@ import urllib.request
 
 DEFAULT_TIMEOUT_SECONDS = 2.0
 
-# The control-plane secret this gateway presents on every /resolve call, read
-# from the env the launcher injects into the gateway container. The control
-# plane requires it (orchestrator/control_plane.py). Constant + env-var name are
-# duplicated here rather than imported because this module is COPYed flat into
-# the gateway image, free of bot-bottle imports — same rationale as
-# IDENTITY_HEADER in egress_addon / git_http_backend.
+# The role-scoped `gateway` token this data plane presents on every control-plane
+# call, read from the env the launcher injects into the gateway (a pre-minted
+# signed JWT — the gateway never holds the signing key, so it can't forge a
+# higher-privilege `cli` token). Constant + env-var name are duplicated here
+# rather than imported because this module is COPYed flat into the gateway image,
+# free of bot-bottle imports — same rationale as IDENTITY_HEADER in egress_addon
+# / git_http_backend.
 CONTROL_AUTH_HEADER = "x-bot-bottle-control-auth"
-CONTROL_PLANE_TOKEN_ENV = "BOT_BOTTLE_CONTROL_PLANE_TOKEN"
+CONTROL_AUTH_JWT_ENV = "BOT_BOTTLE_CONTROL_AUTH_JWT"
 
 
 def _control_auth_headers() -> dict[str, str]:
-    """The auth header to send, or {} when no secret is configured (an open
+    """The auth header to send, or {} when no token is configured (an open
     control plane, e.g. Firecracker behind its nft boundary — sending nothing
     is correct there and harmlessly ignored)."""
-    token = os.environ.get(CONTROL_PLANE_TOKEN_ENV, "").strip()
+    token = os.environ.get(CONTROL_AUTH_JWT_ENV, "").strip()
     return {CONTROL_AUTH_HEADER: token} if token else {}