fix(backend): reconcile reads the booted gateway's CA, not a default (0081)

The gateway-attach reconcile (PRD 0081) gathered its resources via a fresh
default DockerInfraService(), so on a cold-boot bring-up of a NON-default
gateway instance — e.g. an isolated integration test's `-itest-` gateway — it
read the default `bot-bottle-orch-gateway`, which doesn't exist for that
instance, and setUpClass died with "No such container: bot-bottle-orch-gateway"
(the 0081 PR's integration-docker job).

Thread the infra service whose gateway just cold-booted from
DockerInfraService.ensure_running() into DockerBottleBackend so
_gateway_attach_resources() reads THAT gateway's CA. Ordinary construction (no
infra) still falls back to the per-host default singleton — production is
unchanged — and the resources-first / fail-hard reconcile ordering is kept.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/docker/backend.py

@@ -23,7 +23,7 @@ import shutil
 import io
 from contextlib import contextmanager, redirect_stderr
 from pathlib import Path
-from typing import Generator, Sequence
+from typing import TYPE_CHECKING, Generator, Sequence
 
 from ...supervisor.types import SUPERVISE_HOSTNAME, SUPERVISE_PORT
 from ...agent_provider import AgentProvisionPlan
@@ -41,12 +41,27 @@ from . import resolve_plan as _resolve_plan
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
+
+if TYPE_CHECKING:
+    from .infra import DockerInfraService
+
+
 class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan", str]):
     """Docker backend implementation. Selected by BOT_BOTTLE_BACKEND
     when set to `docker`; retained as a legacy/example backend."""
 
     name = "docker"
 
+    def __init__(self, *, infra: "DockerInfraService | None" = None) -> None:
+        # The infra service whose gateway just cold-booted, passed in on the
+        # bring-up reconcile path (PRD 0081) so `_gateway_attach_resources`
+        # reads THAT gateway's CA rather than a fresh default-named service —
+        # otherwise a non-default instance (an isolated integration test's
+        # `-itest-` gateway) reads the default `bot-bottle-orch-gateway`, which
+        # doesn't exist for it (#519 review). None for ordinary construction:
+        # falls back to the per-host default singleton.
+        self._infra = infra
+
     @classmethod
     def is_available(cls) -> bool:
         """`docker` on PATH is sufficient; we don't probe `docker info`
@@ -144,8 +159,8 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
 
     def _gateway_attach_resources(self) -> GatewayAttachResources:
         from .infra import DockerInfraService
-        return GatewayAttachResources(
-            ca_pem=DockerInfraService().gateway().ca_cert_pem())
+        infra = self._infra if self._infra is not None else DockerInfraService()
+        return GatewayAttachResources(ca_pem=infra.gateway().ca_cert_pem())
 
     def _running_bottles(self) -> Sequence[str]:
         from .infra_launch import running_agent_containers