fix(git-gate): make the gateway access-hook executable regardless of copy transport

Cloning/fetching from the git-gate on the Apple-container backend failed with
"empty reply from server" (curl exit 52). Root cause: the git-http handler
crashed on every upload-pack with

    PermissionError: [Errno 13] Permission denied: '/etc/git-gate/access-hook'

The access-hook is exec'd directly, so it needs the x bit. prepare() stages it
0o700 and trusted the gateway copy to carry that mode. `docker cp` does; the
Apple `container cp` (AppleGatewayTransport) does not, landing the hook 0o644 →
EACCES. The unhandled exception killed the handler thread, closing the socket
with no HTTP response — which the client sees as the opaque empty reply.

- provision_git_gate now `chmod +x`es the access-hook on the gateway side after
  the copy, so it's executable under every transport (docker/apple/firecracker).
- git-http handler wraps the access-hook subprocess.run: an OSError /
  SubprocessError (un-execable, timed out) now fails closed with a 503 instead
  of crashing the thread into an empty reply — a gate that can't run its hook
  should deny, visibly.
- Updates the now-misleading "docker cp preserves source mode" comment in
  git_gate.prepare().

Regression tests: provisioning applies +x to the access-hook; the handler
returns 503 (not an empty reply) when the hook can't be exec'd.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/git_http_backend.py

@@ -148,12 +148,24 @@ class GitHttpHandler(BaseHTTPRequestHandler):
                 "GIT_GATE_ACCESS_HOOK", "/etc/git-gate/access-hook",
             )
             peer = self.client_address[0]
-            hook = subprocess.run(
-                [hook_path, "upload-pack", str(repo_dir), peer, peer],
-                capture_output=True,
-                check=False,
-                timeout=GIT_GATE_TIMEOUT_SECS,
-            )
+            try:
+                hook = subprocess.run(
+                    [hook_path, "upload-pack", str(repo_dir), peer, peer],
+                    capture_output=True,
+                    check=False,
+                    timeout=GIT_GATE_TIMEOUT_SECS,
+                )
+            except (OSError, subprocess.SubprocessError) as exc:
+                # The access-hook couldn't be run (missing, not executable,
+                # timed out, …). Fail closed with a real HTTP error rather
+                # than letting the exception kill the handler thread — an
+                # unhandled exception closes the socket with no response, which
+                # the client sees as an opaque "empty reply from server".
+                self.log_message(
+                    "access-hook could not run for %s: %s", parsed.path, exc,
+                )
+                self.send_error(503, "git-gate access-hook unavailable")
+                return
             if hook.returncode != 0:
                 detail = (hook.stderr or hook.stdout).decode(
                     "utf-8", errors="replace",