fix(test): stop the macOS unit tests shelling out to the container CLI

CI's unit + coverage jobs failed with `FileNotFoundError: 'container'`: three
tests reached the real Apple CLI, which exists on a macOS dev host but not on
the Linux runner. They passed locally for that reason alone — and two of them
were quietly creating real Apple networks on the dev host as a side effect.

- `test_enumerate_active_is_empty_while_disabled` asserted the disabled-era
  stub and called `enumerate_active()` unmocked. The backend launches bottles
  again, so it now covers the real enumeration: slug parsing, exclusion of the
  shared gateway/orchestrator singletons, and the CLI-failure path.
- The two orchestrator tests patched `orchestrator_service.container_mod`, but
  `_run_orchestrator_container` reaches the CLI through `ensure_networks`,
  which is imported from the gateway module and resolves `container_mod` in
  *its* namespace. Patch the imported name instead.

Adds a test that the networks exist before the orchestrator runs — the
ordering the escaped call was hiding.

Verified by reproducing the CI environment locally (`PATH` without the
`container` binary): 3 failures before, 1818 passing after.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_macos_gateway.py

@@ -230,7 +230,12 @@ class TestMacosOrchestratorService(unittest.TestCase):
         reaches it there directly, so there is no --publish and no NAT leg."""
         svc = MacosOrchestratorService(repo_root=Path("/r"), host_root=Path("/h"))
         run = Mock(return_value=_ok())
-        with patch(f"{_ORCH}.container_mod") as mod:
+        # `ensure_networks` lives in the gateway module and shells out to the
+        # `container` CLI, which does not exist on the Linux CI host — patch it
+        # here, not gateway.container_mod, since it is called through this
+        # module's imported name.
+        with patch(f"{_ORCH}.container_mod") as mod, \
+                patch(f"{_ORCH}.ensure_networks"):
             mod.run_container_argv = run
             svc._run_orchestrator_container("h1")
         argv = run.call_args.args[0]
@@ -238,9 +243,29 @@ class TestMacosOrchestratorService(unittest.TestCase):
         self.assertEqual(["bot-bottle-mac-gateway"], networks)
         self.assertNotIn("--publish", argv)
 
+    def test_networks_exist_before_the_orchestrator_runs(self) -> None:
+        """The orchestrator is the first container on the shared network, so it
+        has to create it — the gateway that used to do so now starts second."""
+        svc = MacosOrchestratorService(repo_root=Path("/r"), host_root=Path("/h"))
+        order: list[str] = []
+
+        def _networks(*_args: str) -> None:
+            order.append("networks")
+
+        def _run(*_args: list[str]) -> Mock:
+            order.append("run")
+            return _ok()
+
+        with patch(f"{_ORCH}.container_mod") as mod, \
+                patch(f"{_ORCH}.ensure_networks", side_effect=_networks):
+            mod.run_container_argv = Mock(side_effect=_run)
+            svc._run_orchestrator_container("h1")
+        self.assertEqual(["networks", "run"], order)
+
     def test_orchestrator_start_failure_raises(self) -> None:
         svc = MacosOrchestratorService(repo_root=Path("/r"), host_root=Path("/h"))
-        with patch(f"{_ORCH}.container_mod") as mod:
+        with patch(f"{_ORCH}.container_mod") as mod, \
+                patch(f"{_ORCH}.ensure_networks"):
             mod.run_container_argv = Mock(return_value=_fail())
             with self.assertRaises(OrchestratorStartError):
                 svc._run_orchestrator_container("h1")