feat(orchestrator): list_live broker op + reconcile via broker (#468)

Chunk 3 of the host-control-server stack: grow the broker op vocabulary
(PRD gap 3), starting with `list_live`, and invert `reconcile` onto it.

- broker: split the closed op vocabulary into mutation (`launch`/`teardown`,
  carry a bottle id + static flags) and query (`list_live`, carries nothing
  but its op name) kinds. `verify_request` now enforces a **strict schema**
  (open question 1, resolved yes): unknown claim keys are rejected, a mutation
  must name its bottle, and a query that smuggles any id/flag is refused.
- broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the
  backend's live source IPs; a backend enumeration failure is converted to the
  single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker`
  enumerates its labelled containers; `StubBroker` derives from launches (or a
  test override).
- host controller: `POST /broker/live` verifies a signed `list_live` token and
  returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client.
- reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips`
  parameter and pulls the live set from the broker itself — the tell that the
  orchestrator couldn't see the backend goes away. **Fail-safe**: if the broker
  can't return an authoritative set the sweep is skipped, never run against an
  empty/partial set (which would reap healthy rows). The `/reconcile` HTTP
  contract + `OrchestratorClient.reconcile` become a bare trigger.

The macOS launcher's Apple-container enumeration stays for now; it becomes the
host controller's `list_live` when launch itself moves behind the broker (the
pulled-forward chunk 5, next in the stack).

Tests + pyright clean; pylint 10.0 on broker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/docker_broker.py

@@ -71,6 +71,31 @@ class DockerBroker(LaunchBroker):
                 f"docker rm failed for {req.bottle_id}: {proc.stderr.strip()}"
             )
 
+    def _list_live(self) -> list[str]:
+        """Every running bottle container's network IP, from `docker ps` filtered
+        to this broker's label. Raises `DockerBrokerError` if the listing or any
+        inspect fails, so reconcile treats the live set as unknown and skips the
+        sweep rather than reaping healthy rows against a partial enumeration."""
+        listing = self._docker([
+            "docker", "ps", "--filter", f"label={BOTTLE_ID_LABEL}",
+            "--format", "{{.ID}}",
+        ])
+        if listing.returncode != 0:
+            raise DockerBrokerError(f"docker ps failed: {listing.stderr.strip()}")
+        ips: list[str] = []
+        for cid in (line for line in listing.stdout.splitlines() if line):
+            inspected = self._docker([
+                "docker", "inspect", "--format",
+                "{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}", cid,
+            ])
+            if inspected.returncode != 0:
+                raise DockerBrokerError(
+                    f"docker inspect {cid} failed; live set is not authoritative: "
+                    f"{inspected.stderr.strip()}"
+                )
+            ips.extend(ip for ip in inspected.stdout.split() if ip)
+        return ips
+
 
 __all__ = [
     "DockerBroker",