refactor(git-gate): make GitGate a service class in a git_gate package

Turn the git_gate module into a package with GitGate as a concrete service class
(dropping the ABC), mirroring the Supervisor shape. The host-side git-gate
operations are now methods the backend drives:

  git_gate/
    __init__.py  — thin __getattr__ facade (keeps `from bot_bottle.git_gate
                   import …` working; render/hook names lazily forwarded to
                   gateway.git_gate_render)
    plan.py      — GitGatePlan (the launch DTO the backend contract references)
    service.py   — GitGate: prepare / provision_dynamic_keys /
                   revoke_provisioned_keys / preflight_host_keys
    provision.py — deploy-key lifecycle (was git_gate_provision.py)
    host_key.py  — host-key preflight (was git_gate_host_key.py)

The backend launch + base.py preflight now call GitGate() methods instead of the
free functions. The runtime rendering / in-gateway hook execution stay in
gateway/git_gate_render.py (data plane) — only the host-side service moved.

Because the facade forwards names lazily, the ~25 `from bot_bottle.git_gate
import GitGatePlan` call-sites are unchanged, and importing git_gate.plan (the
contract's dependency) no longer drags in the provisioning / forge-API code.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/git_gate/__init__.py

@@ -0,0 +1,98 @@
+"""Per-agent git-gate (PRD 0008).
+
+The git-gate fronts a bottle's declared git upstreams as a transparent mirror:
+a `pre-receive` hook gitleaks-scans pushes and forwards clean refs to the real
+upstream with a gate-resident credential; an `--access-hook` refreshes from the
+upstream before fetches. The agent never sees the upstream credential.
+
+Layout:
+
+  * `service`  — the `GitGate` host-side service (prepare / provision / revoke /
+    preflight) the backend drives at launch.
+  * `plan`     — `GitGatePlan`, the launch DTO (in the backend contract).
+  * `provision`, `host_key` — the deploy-key + host-key host-side helpers the
+    service delegates to.
+
+The rendering + the in-gateway hook execution live in
+`bot_bottle.gateway.git_gate_render`. The public names are re-exported lazily
+via `__getattr__`, so `from bot_bottle.git_gate import …` keeps working and
+importing `git_gate.plan` (the contract's dependency) doesn't drag in the
+provisioning / forge-API code.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from .service import GitGate
+    from .plan import GitGatePlan
+    from .provision import (
+        provision_git_gate_dynamic_keys,
+        revoke_git_gate_provisioned_keys,
+    )
+    from ..gateway.git_gate_render import (
+        GIT_GATE_HOSTNAME,
+        GIT_GATE_TIMEOUT_SECS,
+        GitGateUpstream,
+        git_gate_known_hosts_line,
+        git_gate_render_access_hook,
+        git_gate_render_entrypoint,
+        git_gate_render_gitconfig,
+        git_gate_render_hook,
+        git_gate_render_provision,
+        git_gate_upstreams_for_bottle,
+    )
+
+
+# Public name -> relative module that defines it. Render/hook names come from
+# the gateway (where the in-gateway execution lives); the service, plan, and
+# provisioning are this package's own submodules.
+_LAZY: dict[str, str] = {
+    "GitGate": ".service",
+    "GitGatePlan": ".plan",
+    "provision_git_gate_dynamic_keys": ".provision",
+    "revoke_git_gate_provisioned_keys": ".provision",
+    "_provision_dynamic_key": ".provision",
+    "_resolve_identity_file": ".provision",
+    "GIT_GATE_HOSTNAME": "..gateway.git_gate_render",
+    "GIT_GATE_TIMEOUT_SECS": "..gateway.git_gate_render",
+    "GitGateUpstream": "..gateway.git_gate_render",
+    "git_gate_upstreams_for_bottle": "..gateway.git_gate_render",
+    "git_gate_render_gitconfig": "..gateway.git_gate_render",
+    "git_gate_known_hosts_line": "..gateway.git_gate_render",
+    "git_gate_render_entrypoint": "..gateway.git_gate_render",
+    "git_gate_render_provision": "..gateway.git_gate_render",
+    "git_gate_render_hook": "..gateway.git_gate_render",
+    "git_gate_render_access_hook": "..gateway.git_gate_render",
+    "_gitconfig_validate_value": "..gateway.git_gate_render",
+}
+
+
+def __getattr__(name: str) -> Any:
+    src = _LAZY.get(name)
+    if src is None:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    from importlib import import_module
+
+    value = getattr(import_module(src, __name__), name)
+    globals()[name] = value
+    return value
+
+
+__all__ = [
+    "GitGate",
+    "GitGatePlan",
+    "GitGateUpstream",
+    "GIT_GATE_HOSTNAME",
+    "GIT_GATE_TIMEOUT_SECS",
+    "git_gate_upstreams_for_bottle",
+    "git_gate_render_gitconfig",
+    "git_gate_known_hosts_line",
+    "git_gate_render_entrypoint",
+    "git_gate_render_provision",
+    "git_gate_render_hook",
+    "git_gate_render_access_hook",
+    "provision_git_gate_dynamic_keys",
+    "revoke_git_gate_provisioned_keys",
+]