fix(supervise): reach the queue over RPC, get bot-bottle.db off the data plane

PRD 0070's rule — only the orchestrator opens bot-bottle.db; the data
plane reaches state through the control-plane RPC — was not in force.
Three data-plane daemons held a direct read-write handle on the shared
SQLite file: the supervise MCP server, the egress DLP addon (the most
attack-exposed process, TLS-bumping hostile traffic), and the git-gate
pre-receive hook. An RCE in any of them could read every bottle's
plaintext identity_token and forge attribution fleet-wide (issue #469).

Add the agent half of the supervise flow to the control plane:

  POST /supervise/propose  -> queue a proposal, 201 {proposal_id}
  POST /supervise/poll     -> non-blocking decision poll, 200 {status,...}

Both attribute the caller by (source_ip, identity_token) exactly like
/resolve — never a caller-supplied slug — so a bottle can only ever queue
or read its own proposals even if the data plane is compromised. A decided
poll archives server-side, preserving the archive-after-read contract.

Data plane: the supervise server, egress addon, and git-gate hook now
queue/poll through PolicyResolver.propose_supervise / poll_supervise
instead of opening the DB. supervise_server keeps its ~30s grace window
by polling the RPC; egress keeps its safelist keyed by resolved bottle;
the git-gate hook gets (source_ip, identity_token) from the CGI env.

Packaging: drop the DB bind-mount and SUPERVISE_DB_PATH from the
data-plane containers/VMs (docker gateway + infra, macOS infra,
firecracker infra). The orchestrator remains the sole opener of the one
file via BOT_BOTTLE_ROOT / host_db_path().

Update PRD 0070: the rule is now in force; remove the transitional caveat.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_git_gate.py

@@ -213,22 +213,25 @@ class TestHookRender(unittest.TestCase):
         # the suppressed findings for human approval.
         self.assertIn("--ignore-gitleaks-allow", hook)
         self.assertIn("--report-format=json", hook)
-        self.assertIn("tool=_sv.TOOL_GITLEAKS_ALLOW", hook)
-        self.assertIn("_sv.write_proposal", hook)
-        self.assertIn("_sv.read_response", hook)
-        self.assertIn("SUPERVISE_BOTTLE_SLUG", hook)
+        # The hook queues + polls over the control-plane RPC — it no longer
+        # opens the DB directly (PRD 0070 / issue #469).
+        self.assertIn("tool=TOOL_GITLEAKS_ALLOW", hook)
+        self.assertIn("propose_supervise", hook)
+        self.assertIn("poll_supervise", hook)
+        self.assertIn("SUPERVISE_SOURCE_IP", hook)
+        self.assertIn("SUPERVISE_IDENTITY_TOKEN", hook)
         self.assertIn("supervisor approved # gitleaks:allow", hook)
         self.assertIn("supervisor rejected # gitleaks:allow", hook)
 
     def test_inline_gitleaks_allow_python_imports_work_in_gateway_layout(self):
         hook = git_gate_render_hook()
-        # The gateway image copies supervise.py flat under /app, while
-        # host-side tests import it through the bot_bottle package.
-        # Hooks execute from the bare repo directory, so the embedded
-        # Python must include /app and support both import layouts.
+        # The gateway image copies the package modules flat under /app, while
+        # host-side tests import them through the bot_bottle package. Hooks
+        # execute from the bare repo directory, so the embedded Python must
+        # include /app and support both import layouts.
         self.assertIn('PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}"', hook)
-        self.assertIn("import supervise as _sv", hook)
-        self.assertIn("from bot_bottle import supervise as _sv", hook)
+        self.assertIn("from bot_bottle.policy_resolver import PolicyResolver", hook)
+        self.assertIn("from policy_resolver import PolicyResolver", hook)
 
     def test_inline_gitleaks_allow_fails_closed_without_supervisor(self):
         hook = git_gate_render_hook()