feat(orchestrator): slice 5 — build the consolidated sidecar bundle image (#352)

Answers "where do we build the consolidated sidecar": nowhere, until now.

  * sidecar.py — `Sidecar.ensure_built()` (default no-op) + `DockerSidecar`
    now defaults its image to the real bundle (`bot-bottle-sidecars`) and
    `ensure_built()` builds it from `Dockerfile.sidecars` when
    `docker image inspect` shows it's missing (no-op when present or when no
    dockerfile is configured, e.g. a pre-pulled image). `image_exists()`
    added.
  * service.py — `ensure_sidecar()` now builds then runs.
  * __main__.py — `--sidecar` runs the consolidated bundle (build-if-missing).

Scope note: this builds + launches the bundle *container*; making the
running instance functional across bottles needs the per-bottle,
source-IP-keyed multi-tenant config + registration/reload, and routing
agent bottles to it — the next slices (added to PRD 0070's roadmap).

Tests: unit (docker mocked) — image_exists, ensure_built builds when
missing / no-op when present / no-op without a dockerfile / raises on build
failure; ensure_sidecar builds-then-runs; integration (gated, no heavy
build) — image_exists reflects real docker state. Full suite green (only
pre-existing /bin/sleep errors).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/orchestrator/__main__.py

@@ -38,8 +38,8 @@ def main(argv: list[str] | None = None) -> int:
         help="launch broker: 'stub' records requests; 'docker' runs containers",
     )
     parser.add_argument(
-        "--sidecar-image", default=None,
-        help="if set, run one consolidated per-host sidecar from this image",
+        "--sidecar", action="store_true",
+        help="run one consolidated per-host sidecar bundle (build-if-missing)",
     )
     args = parser.parse_args(argv)
 
@@ -51,10 +51,11 @@ def main(argv: list[str] | None = None) -> int:
     # anything; 'docker' runs real containers (firecracker drops in later).
     secret = secrets.token_bytes(32)
     broker: LaunchBroker = DockerBroker(secret) if args.broker == "docker" else StubBroker(secret)
-    sidecar: Sidecar | None = DockerSidecar(args.sidecar_image) if args.sidecar_image else None
+    sidecar: Sidecar | None = DockerSidecar() if args.sidecar else None
     orchestrator = Orchestrator(registry, broker, secret, sidecar)
 
-    # One persistent per-host sidecar, shared by every bottle (idempotent).
+    # One persistent per-host sidecar, shared by every bottle: build the
+    # bundle image if missing, then bring the singleton up (idempotent).
     if sidecar is not None:
         orchestrator.ensure_sidecar()
         log.info("consolidated sidecar ensured", context={"name": sidecar.name})