fix(docker): disable IPv6 on the gateway network

On a docker daemon that default-enables IPv6 (default-address-pools),
creating the gateway network with only `--subnet` lets the daemon also
attach an fdd0::/64 IPv6 subnet. Its gateway is stored as `::1/64`,
which trips docker's own netip.ParseAddr in `network inspect`/`ls`:

  ParseAddr("fdd0:0:0:6::1/64"): unexpected character, want colon

That poisons every `_network_cidr`/`network ls` read and fails the
docker integration suite intermittently (whichever run the runner's
IPv6 pool index lands on a broken network). bot-bottle attribution
pins IPv4 source IPs and has no IPv6 support, so pass `--ipv6=false`
explicitly at network create to keep the gateway network IPv4-only
regardless of the daemon default.

Note: an already-poisoned runner still needs a one-time
`docker network rm bot-bottle-gateway` (and possibly a daemon
restart) to clear the malformed network.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/docker/gateway.py

@@ -148,6 +148,13 @@ class DockerGateway(Gateway):
                 )
         proc = run_docker([
             "docker", "network", "create",
+            # bot-bottle attribution pins IPv4 source IPs; it has no IPv6
+            # support. Disable IPv6 explicitly so a daemon that default-enables
+            # it (default-address-pools) can't attach an fdd0::/64 subnet — a
+            # malformed `::1/64` gateway address then trips docker's own
+            # ParseAddr in `network inspect`/`ls`, which poisons every launch
+            # that reads this network's subnet.
+            "--ipv6=false",
             "--subnet", self._subnet,
             "--label", f"{_GATEWAY_SUBNET_LABEL}={self._subnet}",
             self.network,

tests/unit/test_orchestrator_gateway.py

@@ -215,6 +215,9 @@ class TestDockerGateway(unittest.TestCase):
         self.assertEqual(
             [[
                 "docker", "network", "create",
+                # IPv6 is disabled so a default-IPv6 daemon can't attach a
+                # malformed fdd0::/64 subnet that breaks `network inspect`.
+                "--ipv6=false",
                 "--subnet", DEFAULT_GATEWAY_SUBNET,
                 "--label",
                 f"bot-bottle.gateway-subnet={DEFAULT_GATEWAY_SUBNET}",