feat(orchestrator): list_live broker op + reconcile via broker (#468)

Chunk 3 of the host-control-server stack: grow the broker op vocabulary
(PRD gap 3), starting with `list_live`, and invert `reconcile` onto it.

- broker: split the closed op vocabulary into mutation (`launch`/`teardown`,
  carry a bottle id + static flags) and query (`list_live`, carries nothing
  but its op name) kinds. `verify_request` now enforces a **strict schema**
  (open question 1, resolved yes): unknown claim keys are rejected, a mutation
  must name its bottle, and a query that smuggles any id/flag is refused.
- broker verb: `LaunchBroker.list_live` / `SubmitBroker.list_live` return the
  backend's live source IPs; a backend enumeration failure is converted to the
  single `BrokerUnavailableError` "live set unknown" signal. `DockerBroker`
  enumerates its labelled containers; `StubBroker` derives from launches (or a
  test override).
- host controller: `POST /broker/live` verifies a signed `list_live` token and
  returns `{source_ips}`; `BrokerClient.list_live` is its drop-in client.
- reconcile: `OrchestratorCore.reconcile()` drops the `live_source_ips`
  parameter and pulls the live set from the broker itself — the tell that the
  orchestrator couldn't see the backend goes away. **Fail-safe**: if the broker
  can't return an authoritative set the sweep is skipped, never run against an
  empty/partial set (which would reap healthy rows). The `/reconcile` HTTP
  contract + `OrchestratorClient.reconcile` become a bare trigger.

The macOS launcher's Apple-container enumeration stays for now; it becomes the
host controller's `list_live` when launch itself moves behind the broker (the
pulled-forward chunk 5, next in the stack).

Tests + pyright clean; pylint 10.0 on broker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_orchestrator_broker_client.py

@@ -113,5 +113,48 @@ class TestSubmit(unittest.TestCase):
                 self.c.submit("tok")
 
 
+class TestListLive(unittest.TestCase):
+    def setUp(self) -> None:
+        self.c = BrokerClient("http://host:8091")
+
+    def test_returns_source_ips(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"source_ips": ["10.0.0.1", "10.0.0.2"]})):
+            self.assertEqual(["10.0.0.1", "10.0.0.2"], self.c.list_live("tok"))
+
+    def test_posts_token_to_live_endpoint(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"source_ips": []})) as m:
+            self.c.list_live("signed-token")
+        request = m.call_args.args[0]
+        self.assertEqual("POST", request.get_method())
+        self.assertTrue(request.full_url.endswith("/broker/live"))
+        self.assertEqual({"token": "signed-token"}, json.loads(request.data))
+
+    def test_non_string_entries_are_filtered(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"source_ips": ["10.0.0.1", 5, None, ""]})):
+            self.assertEqual(["10.0.0.1"], self.c.list_live("tok"))
+
+    def test_missing_source_ips_raises(self) -> None:
+        # A response without the field is malformed — better to fail (reconcile
+        # skips) than to reconcile against a silent empty set.
+        with patch(_URLOPEN, return_value=_resp({})):
+            with self.assertRaises(BrokerClientError):
+                self.c.list_live("tok")
+
+    def test_401_raises_broker_auth_error(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(401, {"error": "bad signature"})):
+            with self.assertRaises(BrokerAuthError):
+                self.c.list_live("forged")
+
+    def test_502_enumeration_failure_is_client_error(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(502, {"error": "docker down"})):
+            with self.assertRaises(BrokerClientError):
+                self.c.list_live("tok")
+
+    def test_unreachable_is_unavailable(self) -> None:
+        with patch(_URLOPEN, side_effect=urllib.error.URLError("refused")):
+            with self.assertRaises(BrokerUnavailableError):
+                self.c.list_live("tok")
+
+
 if __name__ == "__main__":
     unittest.main()