refactor(backend): InfraService ABC + FirecrackerInfraService

Add a backend-neutral `InfraService` ABC (backend/infra_service.py) so all three
backends present the same composer contract: `orchestrator()` / `gateway()`
accessors, `ensure_running(*, startup_timeout) -> str` (the host control-plane
URL), `stop()`, plus concrete `url()` / `is_healthy()` that delegate to the
orchestrator. `DockerInfraService` and `MacosInfraService` now subclass it.

Give firecracker the missing class: `FirecrackerInfraService`
(backend/firecracker/infra.py) wraps the `infra_vm` substrate as the pair
coordinator (adopt-or-boot-both under the singleton flock). `infra_vm` keeps only
the plane-agnostic substrate; its `ensure_running` / `_adopt` / `InfraEndpoint`
move to the class, and the coordinator helpers it now calls cross-module go
public (`singleton_lock` / `expected_version` / `adoptable` /
`record_booted_version`).

Unify the return type on the way: `ensure_running` returns the URL string
everywhere (was `str` for docker, two different `InfraEndpoint`s for
macOS/firecracker), and those `InfraEndpoint`s are deleted — the services are the
source of truth (callers read `gateway().address()` / `orchestrator().url()`).
docker's `url` property becomes the inherited `url()`. backend.py /
consolidated_launch / image_builder + tests updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/docker/infra.py

@@ -40,6 +40,7 @@ from ...gateway import (
     GATEWAY_NAME,
     GATEWAY_NETWORK,
 )
+from ..infra_service import InfraService
 from ...orchestrator.lifecycle import (
     DEFAULT_PORT,
     DEFAULT_STARTUP_TIMEOUT_SECONDS,
@@ -53,7 +54,7 @@ INFRA_NAME = GATEWAY_NAME  # the container agents attribute against is the gatew
 _REPO_ROOT = Path(__file__).resolve().parents[3]
 
 
-class DockerInfraService:
+class DockerInfraService(InfraService):
     """Composes the per-host control plane + gateway as two containers.
 
     `orchestrator_name` / `gateway_name` let callers run independent pairs on
@@ -91,14 +92,6 @@ class DockerInfraService:
         against (gateway IP, git-gate provisioning transport, CA fetch)."""
         return self._gateway_name
 
-    @property
-    def url(self) -> str:
-        """Host-side control-plane URL (the orchestrator's published loopback)."""
-        return self.orchestrator().url()
-
-    def is_healthy(self) -> bool:
-        return self.orchestrator().is_healthy()
-
     def orchestrator(self) -> DockerOrchestrator:
         """The control-plane service. Cheap to reconstruct — `ensure_built`
         builds its image, `ensure_running` brings it up, and the launch flow