feat(orchestrator): list_live broker op + reconcile via broker (#468)

Chunk 3 of the host-control-server stack: grow the broker op vocabulary
(PRD gap 3), starting with `list_live`, and invert `reconcile` onto it.

- broker: split the closed op vocabulary into mutation (`launch`/`teardown`,
  carry a bottle id + static flags) and query (`list_live`, carries nothing
  but its op name) kinds. `verify_request` now enforces a **strict schema**
  (open question 1, resolved yes): unknown claim keys are rejected, a mutation
  must name its bottle, and a query that smuggles any id/flag is refused.
- broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the
  backend's live source IPs; a backend enumeration failure is converted to the
  single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker`
  enumerates its labelled containers; `StubBroker` derives from launches (or a
  test override).
- host controller: `POST /broker/live` verifies a signed `list_live` token and
  returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client.
- reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips`
  parameter and pulls the live set from the broker itself — the tell that the
  orchestrator couldn't see the backend goes away. **Fail-safe**: if the broker
  can't return an authoritative set the sweep is skipped, never run against an
  empty/partial set (which would reap healthy rows). The `/reconcile` HTTP
  contract + `OrchestratorClient.reconcile` become a bare trigger.

The macOS launcher's Apple-container enumeration stays for now; it becomes the
host controller's `list_live` when launch itself moves behind the broker (the
pulled-forward chunk 5, next in the stack).

Tests + pyright clean; pylint 10.0 on broker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/consolidated_launch.py

@@ -166,9 +166,17 @@ def register_agent(
     # collide with this bottle's — and `by_source_ip` fail-closes on ambiguity,
     # which would resolve no policy at all and deny every host. Best-effort: a
     # reconciliation failure must not block an otherwise-fine launch.
+    #
+    # The orchestrator now pulls the live set from the broker itself, so this is
+    # a bare trigger. Until macOS moves onto the host controller (the follow-up
+    # that routes launch through the broker), the orchestrator's broker is the
+    # stub, whose live set is the bottles it recorded launches for — so the sweep
+    # only under-reaps (leaves an orphan a cycle longer), never reaps a healthy
+    # bottle. The Apple-container enumeration below (`live_source_ips`) becomes
+    # that host controller's `list_live` there.
     try:
-        client.reconcile(live_source_ips(endpoint.network))
-    except (OrchestratorClientError, EnumerationError) as e:
+        client.reconcile()
+    except OrchestratorClientError as e:
         info(f"registry reconciliation skipped: {e}")
     reg = provision_bottle(
         client, source_ip, egress_plan, git_gate_plan, MacosGatewayTransport(),