fix(backend): extract poll_ca_cert helper and fix PRD port docs

Extract the shared CA cert polling loop into `backend/util.poll_ca_cert`
(firecracker and macos backends were duplicating deadline/sleep/raise logic).
Each caller now wraps a fetch lambda and converts TimeoutError to its own
error type. Also corrects the PRD port publication line from {port}:{port}
to {host_port}:8099.

docs/prds/prd-new-consolidate-docker-infra-backend.md

@@ -90,8 +90,9 @@ first (`DockerGateway.ensure_running`), then orchestrator. After this PRD:
 - Single `docker run` of `bot-bottle-infra:latest`
 - Container name: `bot-bottle-infra` (replaces `bot-bottle-orch-gateway` +
   `bot-bottle-orchestrator`)
-- Published ports: `127.0.0.1:{port}:{port}` for the control plane (same as
-  today)
+- Published ports: `127.0.0.1:{host_port}:8099` for the control plane
+  (`gateway_init` listens on a fixed internal port 8099; the caller-chosen
+  host port maps to it)
 - Bind mounts: repo root + host root (same as today)
 - `DockerGateway` becomes an implementation detail of `OrchestratorService`
   rather than a separately started container; the gateway image name