feat(orchestrator): slice 5 — build the consolidated sidecar bundle image (#352)

Answers "where do we build the consolidated sidecar": nowhere, until now.

  * sidecar.py — `Sidecar.ensure_built()` (default no-op) + `DockerSidecar`
    now defaults its image to the real bundle (`bot-bottle-sidecars`) and
    `ensure_built()` builds it from `Dockerfile.sidecars` when
    `docker image inspect` shows it's missing (no-op when present or when no
    dockerfile is configured, e.g. a pre-pulled image). `image_exists()`
    added.
  * service.py — `ensure_sidecar()` now builds then runs.
  * __main__.py — `--sidecar` runs the consolidated bundle (build-if-missing).

Scope note: this builds + launches the bundle *container*; making the
running instance functional across bottles needs the per-bottle,
source-IP-keyed multi-tenant config + registration/reload, and routing
agent bottles to it — the next slices (added to PRD 0070's roadmap).

Tests: unit (docker mocked) — image_exists, ensure_built builds when
missing / no-op when present / no-op without a dockerfile / raises on build
failure; ensure_sidecar builds-then-runs; integration (gated, no heavy
build) — image_exists reflects real docker state. Full suite green (only
pre-existing /bin/sleep errors).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_orchestrator_service.py

@@ -30,8 +30,12 @@ class _FakeSidecar(Sidecar):
     def __init__(self) -> None:
         self.name = "fake-sidecar"
         self.ensured = 0
+        self.built = 0
         self._running = False
 
+    def ensure_built(self) -> None:
+        self.built += 1
+
     def ensure_running(self) -> None:
         self.ensured += 1
         self._running = True
@@ -100,7 +104,8 @@ class TestOrchestrator(unittest.TestCase):
             orch.sidecar_status(),
         )
         orch.ensure_sidecar()
-        self.assertEqual(1, sc.ensured)
+        self.assertEqual(1, sc.built)   # ensure_sidecar builds first,
+        self.assertEqual(1, sc.ensured)  # then runs
         self.assertEqual(
             {"configured": True, "name": "fake-sidecar", "running": True},
             orch.sidecar_status(),