feat(backend): add teardown() to the contract; backend teardown

Add an abstract teardown() classmethod to BottleBackend — the inverse of
setup(), surfaced as `./cli.py backend teardown [--backend=NAME]`
(uninstall). Symmetric with setup: it prints the privileged commands /
declarative config change to remove the host prerequisites.

- firecracker: NixOS-aware — disable the flake module (or drop the
  import) and rebuild, or `firecracker-netpool.sh down` imperatively.
- docker / macos-container: nothing to undo (no privileged host state);
  print a short note.

Not called by the launch path or the test suite. Extends test_cli_backend
for the new dispatch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/backend/__init__.py

@@ -560,6 +560,17 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         the backend is ready to launch and non-zero when something is
         missing. Invoked by `./cli.py backend status [--backend=…]`."""
 
+    @classmethod
+    @abstractmethod
+    def teardown(cls) -> int:
+        """Undo `setup()` — the inverse operation, surfaced as
+        `./cli.py backend teardown [--backend=…]` (uninstall). Symmetric
+        with setup: where setup is advisory (prints the privileged
+        commands / declarative config to apply), teardown prints the
+        commands / config change to remove the host prerequisites. A
+        backend with no host setup prints a short note and returns 0.
+        Not called by the launch path or the test suite."""
+
 
 # Import concrete backend classes AFTER the base types are defined, so
 # each backend module can pull BottleSpec / BottlePlan / BottleBackend

bot_bottle/backend/docker/backend.py

@@ -64,6 +64,11 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
         from . import setup as _setup
         return _setup.status()
 
+    @classmethod
+    def teardown(cls) -> int:
+        from . import setup as _setup
+        return _setup.teardown()
+
     def _preflight(self) -> None:
         _resolve_plan.preflight()
 

bot_bottle/backend/docker/setup.py

@@ -61,6 +61,15 @@ def setup() -> int:
     return 0
 
 
+def teardown() -> int:
+    sys.stderr.write(
+        "Docker backend: nothing to undo — it provisions no privileged host "
+        "state (networks and the sidecar bundle are per-launch and are "
+        "removed by `./cli.py cleanup`). Docker itself is left installed.\n"
+    )
+    return 0
+
+
 def status() -> int:
     ok = True
     if _docker_on_path():

bot_bottle/backend/firecracker/backend.py

@@ -56,6 +56,11 @@ class FirecrackerBottleBackend(
         from . import setup as _setup
         return _setup.status()
 
+    @classmethod
+    def teardown(cls) -> int:
+        from . import setup as _setup
+        return _setup.teardown()
+
     def _preflight(self) -> None:
         _resolve_plan.preflight()
 

bot_bottle/backend/firecracker/setup.py

@@ -81,6 +81,25 @@ def setup() -> int:
     return 0
 
 
+def teardown() -> int:
+    slots = netpool.all_slots()
+    sys.stderr.write(
+        f"Undo the Firecracker network pool ({len(slots)} slots, base "
+        f"{netpool.ip_base()}) — a privileged, one-time operation.\n\n"
+    )
+    if _is_nixos():
+        sys.stderr.write(
+            "On NixOS: set `services.bot-bottle-firecracker.enable = false;` "
+            "(or drop the module import) and `nixos-rebuild switch`. The TAP "
+            "netdevs and nft table are removed declaratively.\n\n"
+            "To tear down imperatively before a rebuild (does not persist):\n\n"
+        )
+    else:
+        sys.stderr.write("Run the teardown as root:\n\n")
+    sys.stdout.write("sudo ./scripts/firecracker-netpool.sh down\n")
+    return 0
+
+
 def status() -> int:
     ok = True
     if netpool.nft_table_present():

bot_bottle/backend/macos_container/backend.py

@@ -46,6 +46,11 @@ class MacosContainerBottleBackend(
         from . import setup as _setup
         return _setup.status()
 
+    @classmethod
+    def teardown(cls) -> int:
+        from . import setup as _setup
+        return _setup.teardown()
+
     def _preflight(self) -> None:
         _resolve_plan.preflight()
 

bot_bottle/backend/macos_container/setup.py

@@ -46,6 +46,16 @@ def setup() -> int:
     return 0
 
 
+def teardown() -> int:
+    sys.stderr.write(
+        "macos-container backend: nothing to undo — it provisions no "
+        "privileged host state. The Apple Container CLI and its system "
+        "service are left as-is (stop the service yourself with "
+        "`container system stop` if you want).\n"
+    )
+    return 0
+
+
 def status() -> int:
     ok = True
     if _container.is_macos():