refactor(backend): rename consolidated_launch -> infra_launch (0081 review)

Mechanical rename addressing review 6141 on #519: "consolidated launch" was
unclear about what it composes. Rename the per-backend module
`consolidated_launch.py` -> `infra_launch.py` and the error
`ConsolidatedLaunchError` -> `InfraLaunchError` across all three backends and
their callers/tests. Unify the three identical per-backend error classes into
one `InfraLaunchError` defined in `backend/base.py` (re-exported by each
`infra_launch`) so the base backend can raise and catch a single shared type —
groundwork for the base owning the gateway-attach flow.

Add a glossary entry defining **infra** = the per-host gateway + orchestrator
service pair every bottle attaches to.

No behavior change.

Refs #516, #519.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/backend.py

@@ -118,7 +118,7 @@ class MacosContainerBottleBackend(
         return _enumerate.enumerate_active()
 
     def attach_bottled_agents_to_gateway(self) -> None:
-        from .consolidated_launch import attach_bottled_agents_to_gateway
+        from .infra_launch import attach_bottled_agents_to_gateway
         attach_bottled_agents_to_gateway()
 
     def supervise_mcp_url(self, plan: MacosContainerBottlePlan) -> str:

bot_bottle/backend/macos_container/infra_launch.py

@@ -43,6 +43,7 @@ from ...log import info
 from ...orchestrator.client import OrchestratorClient, OrchestratorClientError
 from ...orchestrator.reprovision import reprovision_bottles
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
+from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
 from ..util import AGENT_CA_PATH
 from . import util as container_mod
@@ -52,10 +53,6 @@ from .gateway_transport import MacosGatewayTransport
 from .infra import MacosInfraService, OrchestratorStartError
 
 
-class ConsolidatedLaunchError(RuntimeError):
-    """The consolidated register/provision sequence could not complete."""
-
-
 @dataclass(frozen=True)
 class GatewayEndpoint:
     """What the agent `container run` needs to reach the shared gateway.
@@ -104,13 +101,13 @@ def _push_ca_to_container(name: str, ca_pem: str) -> None:
     """Replace one running agent container's trusted gateway CA with `ca_pem`
     and rebuild its trust store via `container cp` + `container exec`.
     Unconditional install — there is one gateway, so no fingerprint match is
-    needed. Raises `ConsolidatedLaunchError` on failure."""
+    needed. Raises `InfraLaunchError` on failure."""
     mkdir = container_mod.run_container_argv(
         ["container", "exec", name, "mkdir", "-p",
          "/usr/local/share/ca-certificates"]
     )
     if mkdir.returncode != 0:
-        raise ConsolidatedLaunchError(
+        raise InfraLaunchError(
             f"CA push to {name} failed (mkdir): {(mkdir.stderr or '').strip()}"
         )
     with tempfile.NamedTemporaryFile("w", suffix=".crt") as tmp:
@@ -120,7 +117,7 @@ def _push_ca_to_container(name: str, ca_pem: str) -> None:
             ["container", "cp", tmp.name, f"{name}:{AGENT_CA_PATH}"]
         )
     if cp.returncode != 0:
-        raise ConsolidatedLaunchError(
+        raise InfraLaunchError(
             f"CA push to {name} failed (cp): {(cp.stderr or '').strip()}"
         )
     ex = container_mod.run_container_argv(
@@ -128,7 +125,7 @@ def _push_ca_to_container(name: str, ca_pem: str) -> None:
          f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates"]
     )
     if ex.returncode != 0:
-        raise ConsolidatedLaunchError(
+        raise InfraLaunchError(
             f"CA push to {name} failed (update-ca-certificates): "
             f"{(ex.stderr or '').strip()}"
         )
@@ -154,7 +151,7 @@ def attach_bottled_agents_to_gateway(ca_pem: str | None = None) -> None:
         try:
             _push_ca_to_container(name, ca_pem)
             reconciled += 1
-        except (OSError, ConsolidatedLaunchError) as exc:
+        except (OSError, InfraLaunchError) as exc:
             info(f"CA reconcile skipped for {name}: {exc}")
     if reconciled:
         info(f"reconciled gateway CA into {reconciled} running macOS bottle(s)")
@@ -266,7 +263,7 @@ __all__ = [
     "live_source_ips",
     "register_agent",
     "deprovision_consolidated",
-    "ConsolidatedLaunchError",
+    "InfraLaunchError",
     "OrchestratorStartError",
     "GATEWAY_NETWORK",
 ]

bot_bottle/backend/macos_container/launch.py

@@ -5,7 +5,7 @@ proxies egress through the one per-host gateway, replacing the per-bottle
 companion container removed in #385.
 
 The order differs from docker's, forced by Apple Container 1.0.0 having no
-`--ip` (see `consolidated_launch`): the agent is started *before* it is
+`--ip` (see `infra_launch`): the agent is started *before* it is
 registered, because its DHCP-assigned address — the attribution key — does not
 exist until then.
 
@@ -64,7 +64,7 @@ from . import nested_containers as nested_containers_mod
 from .bottle_plan import MacosContainerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME, new_env_var_secret
-from .consolidated_launch import (
+from .infra_launch import (
     GatewayEndpoint,
     ensure_gateway,
     register_agent,