refactor(git-gate): make GitGate a service class in a git_gate package

Turn the git_gate module into a package with GitGate as a concrete service class
(dropping the ABC), mirroring the Supervisor shape. The host-side git-gate
operations are now methods the backend drives:

  git_gate/
    __init__.py  — thin __getattr__ facade (keeps `from bot_bottle.git_gate
                   import …` working; render/hook names lazily forwarded to
                   gateway.git_gate_render)
    plan.py      — GitGatePlan (the launch DTO the backend contract references)
    service.py   — GitGate: prepare / provision_dynamic_keys /
                   revoke_provisioned_keys / preflight_host_keys
    provision.py — deploy-key lifecycle (was git_gate_provision.py)
    host_key.py  — host-key preflight (was git_gate_host_key.py)

The backend launch + base.py preflight now call GitGate() methods instead of the
free functions. The runtime rendering / in-gateway hook execution stay in
gateway/git_gate_render.py (data plane) — only the host-side service moved.

Because the facade forwards names lazily, the ~25 `from bot_bottle.git_gate
import GitGatePlan` call-sites are unchanged, and importing git_gate.plan (the
contract's dependency) no longer drags in the provisioning / forge-API code.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/git_gate/plan.py

@@ -0,0 +1,36 @@
+"""`GitGatePlan` — the git-gate launch plan (DTO).
+
+The output of `GitGate.prepare`, consumed by the backend launch step and the
+`BottlePlan` contract. A pure value type (its `upstreams` element type
+`GitGateUpstream` is the neutral render dataclass).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from ..gateway.git_gate_render import GitGateUpstream
+
+
+@dataclass(frozen=True)
+class GitGatePlan:
+    """Output of GitGate.prepare; consumed by .start.
+
+    The script + slug + upstream fields are filled at prepare time (host-side,
+    side-effect-free on docker). The network fields are populated by the
+    backend's launch step via `dataclasses.replace` once those networks exist.
+    Empty defaults are sentinels meaning "not yet set"; `.start` validates that
+    they are populated.
+
+    `hook_script` is the shared `pre-receive` for push-time gating;
+    `access_hook_script` is `git daemon`'s `--access-hook` for the fetch-time
+    upstream refresh."""
+
+    slug: str
+    entrypoint_script: Path
+    hook_script: Path
+    access_hook_script: Path
+    upstreams: tuple[GitGateUpstream, ...]
+    internal_network: str = ""
+    egress_network: str = ""