feat(backend): reconcile running bottles' CA on gateway bring-up (0081)

Add `attach_bottled_agents_to_gateway()` as an `@abc.abstractmethod` on
`BottleBackend` and implement the first reconcile step across all three
backends: on a gateway cold boot, replace every already-running agent's
trusted CA with the freshly-minted gateway CA. Reconciling running bottles
is a backend responsibility (only the backend can enumerate its agents and
reach them — firecracker over SSH, docker/macOS over exec/cp), so making it
an abstract method keeps the fix cross-backend by construction.

The gateway rootfs is ephemeral, so a rebuild mints a new CA that every
running bottle distrusts (SSL verification fails — #510). This reconcile is
what distributes the fresh CA, so a routine gateway rebuild now doubles as a
free CA rotation. Per-bottle steps are best-effort: one unreachable or
malformed bottle is logged and skipped, never blocking the others.

Trigger — `Gateway.connect_to_orchestrator` now returns a cold-boot bool
(True when it actually (re)brought the gateway up, False when a healthy
current gateway was left untouched); each infra `ensure_running` gates the
reconcile on it, so it fires exactly on cold boot and never on an adopt.

Git-gate re-provision and egress-token restore fold into this same reconcile
on the same trigger in follow-up PRs (#516).

Refs #516. Addresses #510.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_macos_infra.py

@@ -24,10 +24,20 @@ class TestInfraEnsureRunning(unittest.TestCase):
         self.orch.url.return_value = "http://192.168.128.2:8099"
         self.orch.mint_gateway_token.return_value = "gw.jwt"
         self.gw = MagicMock()
+        # Default to a cold boot (gateway (re)created) so the reconcile branch
+        # runs; the actual reconcile is stubbed so these composition tests stay
+        # isolated from the `container` CLI.
+        self.gw.connect_to_orchestrator.return_value = True
         for name, mock in (("orchestrator", self.orch), ("gateway", self.gw)):
             p = patch.object(self.svc, name, return_value=mock)
             p.start()
             self.addCleanup(p.stop)
+        ap = patch(
+            "bot_bottle.backend.macos_container.backend"
+            ".MacosContainerBottleBackend.attach_bottled_agents_to_gateway"
+        )
+        self.attach = ap.start()
+        self.addCleanup(ap.stop)
 
     def test_composes_networks_builds_and_brings_up_orchestrator_first(self) -> None:
         with patch(f"{_INFRA}.ensure_networks") as nets:
@@ -46,6 +56,20 @@ class TestInfraEnsureRunning(unittest.TestCase):
             "http://192.168.128.2:8099", "gw.jwt")
         self.orch.mint_gateway_token.assert_called_once()
 
+    def test_cold_boot_reconciles_running_bottles(self) -> None:
+        # A (re)created gateway (connect returns True) triggers the bring-up
+        # reconcile so running bottles re-trust the fresh gateway (PRD 0081).
+        self.gw.connect_to_orchestrator.return_value = True
+        with patch(f"{_INFRA}.ensure_networks"):
+            self.svc.ensure_running()
+        self.attach.assert_called_once_with()
+
+    def test_no_reconcile_when_gateway_left_untouched(self) -> None:
+        self.gw.connect_to_orchestrator.return_value = False
+        with patch(f"{_INFRA}.ensure_networks"):
+            self.svc.ensure_running()
+        self.attach.assert_not_called()
+
     def test_is_healthy_delegates_to_the_orchestrator(self) -> None:
         self.orch.is_healthy.return_value = True
         self.assertTrue(self.svc.is_healthy())