refactor(orchestrator): split conflated sidecar image into orchestrator + gateway images

One image — `bot-bottle-sidecars:latest`, built from `Dockerfile.sidecars` —
served two unrelated roles: the egress/git-gate/supervise *data plane* and
the orchestrator *control plane* (which ran the same image with the entrypoint
overridden to `python3 -m bot_bottle.orchestrator`). The control plane is
stdlib-only, so it needed none of the mitmproxy/git/gitleaks payload it was
riding on — while being the most secret-dense process on the host (PRD 0070's
"secret concentration").

Split into two purpose-built images:

- `Dockerfile.gateway` -> `bot-bottle-gateway:latest` — the data plane
  (renamed from Dockerfile.sidecars; identical contents).
- `Dockerfile.orchestrator` -> `bot-bottle-orchestrator:latest` — a lean
  `python:3.12-slim` runtime; the bind-mounted `bot_bottle` package supplies
  the code (so the #381 source-hash recreate semantics are unchanged).

`OrchestratorService` now takes distinct `image` (control plane, default
`ORCHESTRATOR_IMAGE`) and `gateway_image` (data plane, default `GATEWAY_IMAGE`)
instead of feeding one `self.image` to both, and builds the lean image
(build-if-missing) before starting the container. The per-bottle bundle
constants in `backend/docker/sidecar_bundle.py` now alias the gateway
constants so a bundle and the shared gateway can never drift onto different
images. The `bot-bottle-sidecars` *image* name and `Dockerfile.sidecars` are
gone; the per-bottle *container* name prefix (`bot-bottle-sidecars-<slug>`) is
intentionally left for a separate change.

Verified end-to-end: both images build; the lean image runs the control plane;
`ensure_running` brings up the orchestrator on `bot-bottle-orchestrator:latest`
and the gateway on `bot-bottle-gateway:latest` (distinct images) and reports
healthy.

Closes #384.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/README.md

@@ -48,7 +48,7 @@ Discovery is invoked with `-t .` (top-level dir = repo root) so the
   the bottle's runtime, and creates zero Docker resources.
 - `test_orphan_cleanup.py` — `network_remove` is idempotent against
   missing resources, so the EXIT trap can call it unconditionally.
-- `test_sidecar_bundle_image.py` — builds Dockerfile.sidecars and
+- `test_sidecar_bundle_image.py` — builds Dockerfile.gateway and
   probes that gitleaks / mitmdump / supervise are all reachable
   inside the bundle.
 - `test_sidecar_bundle_compose.py` — end-to-end compose-up of an

tests/integration/test_orchestrator_docker_gateway_build.py

@@ -21,7 +21,7 @@ IMAGE = "busybox"
 class TestDockerGatewayImageExists(unittest.TestCase):
     def test_image_exists_true_for_present_false_for_absent(self) -> None:
         # Ensure the tiny image is present (build_if_missing is disabled here
-        # so this never triggers a Dockerfile.sidecars build).
+        # so this never triggers a Dockerfile.gateway build).
         subprocess.run(
             ["docker", "pull", IMAGE],
             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,

tests/integration/test_sidecar_bundle_image.py

@@ -6,7 +6,7 @@ config (routes.yaml, etc) — that lands in chunk 2 when the
 renderer wires the bundle into compose. What we verify here is
 the chunk-1 contract:
 
-  - Dockerfile.sidecars builds (multi-stage works, base layers
+  - Dockerfile.gateway builds (multi-stage works, base layers
     pull, COPYs resolve).
   - gitleaks, mitmdump are at the documented paths and answer
     `--version`.
@@ -28,8 +28,8 @@ import unittest
 from tests._docker import skip_unless_docker
 
 
-_IMAGE = "bot-bottle-sidecars-test:chunk1"
-_DOCKERFILE = "Dockerfile.sidecars"
+_IMAGE = "bot-bottle-gateway-test:chunk1"
+_DOCKERFILE = "Dockerfile.gateway"
 
 
 @skip_unless_docker()

tests/unit/test_compose.py

@@ -297,8 +297,8 @@ class TestSidecarBundleShape(unittest.TestCase):
 
     def test_bundle_uses_bundle_image_and_dockerfile(self):
         sc = self._render()["services"]["sidecars"]
-        self.assertEqual("bot-bottle-sidecars:latest", sc["image"])
-        self.assertEqual("Dockerfile.sidecars", sc["build"]["dockerfile"])
+        self.assertEqual("bot-bottle-gateway:latest", sc["image"])
+        self.assertEqual("Dockerfile.gateway", sc["build"]["dockerfile"])
 
     def test_bundle_container_name_uses_sidecars_prefix(self):
         sc = self._render()["services"]["sidecars"]

tests/unit/test_macos_container_util.py

@@ -88,14 +88,14 @@ resolver #2
                  "BOT_BOTTLE_MACOS_CONTAINER_DNS": "9.9.9.9",
              }):
             util.build_image(
-                "bot-bottle-sidecars:latest",
+                "bot-bottle-gateway:latest",
                 "/repo",
-                dockerfile="Dockerfile.sidecars",
+                dockerfile="Dockerfile.gateway",
             )
         self.assertEqual(
             [
-                "container", "build", "-t", "bot-bottle-sidecars:latest",
-                "--dns", "9.9.9.9", "-f", "/repo/Dockerfile.sidecars", "/repo",
+                "container", "build", "-t", "bot-bottle-gateway:latest",
+                "--dns", "9.9.9.9", "-f", "/repo/Dockerfile.gateway", "/repo",
             ],
             run.call_args_list[-1].args[0],
         )

tests/unit/test_orchestrator_gateway.py

@@ -24,7 +24,7 @@ def _proc(returncode: int = 0, stdout: str = "", stderr: str = "") -> Mock:
 
 class TestDockerGateway(unittest.TestCase):
     def setUp(self) -> None:
-        self.sc = DockerGateway("bot-bottle-sidecars:latest")
+        self.sc = DockerGateway("bot-bottle-gateway:latest")
 
     def test_default_name(self) -> None:
         self.assertEqual(GATEWAY_NAME, self.sc.name)
@@ -86,7 +86,7 @@ class TestDockerGateway(unittest.TestCase):
         runs = [c for c in calls if c[:2] == ["docker", "run"]]
         self.assertEqual(1, len(runs))
         self.assertIn(self.sc.name, runs[0])
-        self.assertIn("bot-bottle-sidecars:latest", runs[0])
+        self.assertIn("bot-bottle-gateway:latest", runs[0])
         # Runs on the shared gateway network so agents can reach it by IP.
         self.assertEqual(self.sc.network, runs[0][runs[0].index("--network") + 1])
         # Persists its CA on a named volume so agents keep trusting it.
@@ -183,7 +183,7 @@ class TestDockerGatewayBuild(unittest.TestCase):
         builds = [c for c in calls if c[:2] == ["docker", "build"]]
         self.assertEqual(1, len(builds))
         self.assertIn(self.sc.image_ref, builds[0])
-        self.assertTrue(any(a.endswith("Dockerfile.sidecars") for a in builds[0]))
+        self.assertTrue(any(a.endswith("Dockerfile.gateway") for a in builds[0]))
         self.assertNotIn("--no-cache", builds[0])
 
     def test_ensure_built_no_cache_env_forces_full_rebuild(self) -> None:

tests/unit/test_orchestrator_lifecycle.py

@@ -9,6 +9,7 @@ from pathlib import Path
 from unittest.mock import MagicMock, Mock, patch
 
 from bot_bottle.orchestrator.lifecycle import (
+    ORCHESTRATOR_IMAGE,
     ORCHESTRATOR_NAME,
     ORCHESTRATOR_SOURCE_HASH_LABEL,
     OrchestratorService,
@@ -121,6 +122,45 @@ class TestOrchestratorService(unittest.TestCase):
         self.assertIn("bot_bottle.orchestrator", argv)
         self.assertEqual("127.0.0.1:8099:8099", argv[argv.index("--publish") + 1])
 
+    def test_ensure_running_builds_lean_orchestrator_image_when_missing(self) -> None:
+        # The control plane runs its own lean image (#384), distinct from the
+        # gateway data plane — built from Dockerfile.orchestrator when absent.
+        calls: list[list[str]] = []
+
+        def fake(argv: list[str]) -> Mock:
+            calls.append(argv)
+            if argv[:2] == ["docker", "ps"]:
+                return _proc(stdout="")                 # orchestrator not running
+            if argv[:3] == ["docker", "image", "inspect"]:
+                return _proc(returncode=1)               # image absent -> build
+            return _proc()
+
+        with patch(_URLOPEN, side_effect=[urllib.error.URLError("down"), _health(200)]), \
+                patch(_GATEWAY), patch(_RUN, side_effect=fake), patch(_SLEEP):
+            self.svc.ensure_running()
+        builds = [c for c in calls if c[:2] == ["docker", "build"]]
+        self.assertEqual(1, len(builds))
+        self.assertIn(ORCHESTRATOR_IMAGE, builds[0])
+        self.assertTrue(any(a.endswith("Dockerfile.orchestrator") for a in builds[0]))
+        # It is NOT the gateway image/dockerfile — the split is the point.
+        self.assertFalse(any("Dockerfile.gateway" in a for a in builds[0]))
+
+    def test_ensure_running_skips_orchestrator_image_build_when_present(self) -> None:
+        calls: list[list[str]] = []
+
+        def fake(argv: list[str]) -> Mock:
+            calls.append(argv)
+            if argv[:2] == ["docker", "ps"]:
+                return _proc(stdout="")
+            if argv[:3] == ["docker", "image", "inspect"]:
+                return _proc(returncode=0)               # image present -> no build
+            return _proc()
+
+        with patch(_URLOPEN, side_effect=[urllib.error.URLError("down"), _health(200)]), \
+                patch(_GATEWAY), patch(_RUN, side_effect=fake), patch(_SLEEP):
+            self.svc.ensure_running()
+        self.assertEqual([], [c for c in calls if c[:2] == ["docker", "build"]])
+
     def test_ensure_running_raises_on_timeout(self) -> None:
         with patch(_URLOPEN, side_effect=urllib.error.URLError("down")), \
                 patch(_GATEWAY), patch(_RUN, return_value=Mock(returncode=0, stderr="")), \