feat(firecracker): git-gate over SSH into the gateway VM (Stage B, 7/n)

git-gate now works end-to-end for git-upstream bottles on the infra VM.
Three fixes surfaced by driving a real clone through git-http:

- `SshGatewayTransport.cp_into` preserves the source file mode (docker cp
  does). The access-hook is staged 0700 and git-http execs it directly; a
  plain `cat >` landed it 0644 -> EACCES. Keys stay 0600.
- the infra init runs `BOT_BOTTLE_GATEWAY_DAEMONS=egress,git-http,supervise`:
  the VM backend reaches git over git-http (9420), so the git:// daemon
  (git-gate, whose /git-gate-entrypoint.sh the consolidated model doesn't
  stage) is left out instead of crash-looping.
- `build_infra_rootfs_dir` folds the init's content-hash into the rootfs
  cache key, so an init change actually rebuilds the rootfs (the base image
  digest alone wouldn't catch it).

Verified on a KVM host: launch_consolidated provisions a git-upstream
bottle's repo + creds into the gateway VM over SSH; an agent VM clones via
git-http (source-IP attributed) and the access-hook resolves the
provisioned key + known_hosts and attempts the upstream SSH fetch —
failing closed only because the test used a dummy key + fake upstream
("refusing to serve stale data"). With real creds the fetch serves.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_firecracker_infra_vm.py

@@ -31,7 +31,8 @@ class TestBuildInfraRootfs(unittest.TestCase):
             infra_vm.build_infra_rootfs_dir()
         build.assert_called_once()
         self.assertEqual(infra_vm._INFRA_IMAGE, build.call_args.args[0])
-        self.assertEqual("-infra", build.call_args.kwargs["variant"])
+        # variant is "-infra-<init-hash>" so an init change rebuilds the rootfs.
+        self.assertTrue(build.call_args.kwargs["variant"].startswith("-infra-"))
         # The init runs BOTH the control plane and the gateway data plane,
         # and exports PATH so gateway_init's subprocess daemons find python3.
         init = build.call_args.kwargs["init_script"]
@@ -40,6 +41,31 @@ class TestBuildInfraRootfs(unittest.TestCase):
         self.assertIn("export PATH=", init)
         # Persistent registry volume mounted at the DB dir before the CP starts.
         self.assertIn("/dev/vdb", init)
+        # VM backend uses git-http (9420); the git:// daemon is left out.
+        self.assertIn("BOT_BOTTLE_GATEWAY_DAEMONS=egress,git-http,supervise", init)
+
+
+class TestSshGatewayTransport(unittest.TestCase):
+    def test_cp_into_preserves_source_mode(self):
+        import os
+        import tempfile
+        from subprocess import CompletedProcess
+        with tempfile.NamedTemporaryFile() as f:
+            os.chmod(f.name, 0o700)  # like the staged access-hook
+            t = infra_vm.SshGatewayTransport(Path("/k"), "10.0.0.1")
+            with patch.object(infra_vm.subprocess, "run",
+                              return_value=CompletedProcess([], 0)) as run:
+                t.cp_into(f.name, "/etc/git-gate/access-hook")
+        remote_cmd = run.call_args.args[0][-1]
+        self.assertIn("chmod 700", remote_cmd)  # exec bit preserved over SSH
+
+    def test_exec_raises_on_failure(self):
+        from subprocess import CompletedProcess
+        t = infra_vm.SshGatewayTransport(Path("/k"), "10.0.0.1")
+        with patch.object(infra_vm.subprocess, "run",
+                          return_value=CompletedProcess([], 1, stderr="nope")), \
+             self.assertRaises(infra_vm.GatewayProvisionError):
+            t.exec(["mkdir", "-p", "/git-gate"])
 
 
 class TestRegistryVolume(unittest.TestCase):