fix(backend): reconcile reads the booted gateway's CA, not a default (0081)

The gateway-attach reconcile (PRD 0081) gathered its resources via a fresh
default DockerInfraService(), so on a cold-boot bring-up of a NON-default
gateway instance — e.g. an isolated integration test's `-itest-` gateway — it
read the default `bot-bottle-orch-gateway`, which doesn't exist for that
instance, and setUpClass died with "No such container: bot-bottle-orch-gateway"
(the 0081 PR's integration-docker job).

Thread the infra service whose gateway just cold-booted from
DockerInfraService.ensure_running() into DockerBottleBackend so
_gateway_attach_resources() reads THAT gateway's CA. Ordinary construction (no
infra) still falls back to the per-host default singleton — production is
unchanged — and the resources-first / fail-hard reconcile ordering is kept.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_backend_secret_reprovision.py

@@ -277,6 +277,27 @@ class TestDockerAttachPrimitives(unittest.TestCase):
             with self.assertRaisesRegex(docker.InfraLaunchError, "gone"):
                 docker.push_ca_to_container("bot-bottle-a", "PEM")
 
+    def test_gateway_attach_resources_reads_the_threaded_infra_gateway(self) -> None:
+        # On the bring-up reconcile path the backend is threaded with the infra
+        # whose gateway just cold-booted, so it reads THAT gateway's CA — not a
+        # fresh default-named DockerInfraService that wouldn't exist for a
+        # non-default instance (#519 review).
+        from bot_bottle.backend.docker.backend import DockerBottleBackend
+        infra = Mock()
+        infra.gateway.return_value.ca_cert_pem.return_value = "ITEST-CA"
+        res = DockerBottleBackend(infra=infra)._gateway_attach_resources()
+        self.assertEqual("ITEST-CA", res.ca_pem)
+        infra.gateway.assert_called_once()
+
+    def test_gateway_attach_resources_defaults_to_the_host_singleton(self) -> None:
+        # Ordinary construction (no infra) falls back to the per-host default.
+        from bot_bottle.backend.docker.backend import DockerBottleBackend
+        with patch("bot_bottle.backend.docker.infra.DockerInfraService") as InfraCls:
+            InfraCls.return_value.gateway.return_value.ca_cert_pem.return_value = "DEFAULT-CA"
+            res = DockerBottleBackend()._gateway_attach_resources()
+        InfraCls.assert_called_once_with()
+        self.assertEqual("DEFAULT-CA", res.ca_pem)
+
 
 class TestMacosAttachPrimitives(unittest.TestCase):
     def test_running_agent_containers_from_enumeration(self) -> None: