refactor(docker): rename OrchestratorService -> DockerInfraService, move to backend/docker

OrchestratorService wasn't the orchestrator — it's the host-side lifecycle of
the docker infra *container* (the one that runs the Orchestrator). It read as
"the orchestrator as a service" and lived in orchestrator/lifecycle.py, while
its siblings (macOS MacosInfraService, Firecracker infra_vm) live under their
backend package. Rename it DockerInfraService and move it to
backend/docker/infra.py alongside the docker backend, with its docker-only
constants (INFRA_*/ORCHESTRATOR_* image + container names, daemon list, mount
paths).

orchestrator/lifecycle.py keeps only the backend-neutral pieces the other infra
services share — DEFAULT_PORT, DEFAULT_STARTUP_TIMEOUT_SECONDS,
OrchestratorStartError, source_hash — which macOS / firecracker / client still
import from there. backend/docker/infra.py imports those (backend -> orchestrator
is an allowed direction). Renamed the unit test to test_docker_infra.py.

Full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/integration/test_multitenant_isolation.py

@@ -30,7 +30,7 @@ from bot_bottle.backend.docker.egress import EGRESS_PORT
 from bot_bottle.backend.docker.gateway_net import next_free_ip
 from bot_bottle.orchestrator.client import OrchestratorClient
 from bot_bottle.gateway import GATEWAY_IMAGE, GATEWAY_NAME, GATEWAY_NETWORK
-from bot_bottle.orchestrator.lifecycle import OrchestratorService
+from bot_bottle.backend.docker.infra import DockerInfraService
 from tests._docker import skip_unless_docker
 
 # One upstream reachable under two names; reflects the Authorization header so
@@ -85,7 +85,7 @@ class TestMultitenantIsolation(unittest.TestCase):
         self._tmp = tempfile.TemporaryDirectory()
         self.addCleanup(self._tmp.cleanup)
         # Throwaway root → a clean registry DB, independent of the host's.
-        self.svc = OrchestratorService(host_root=Path(self._tmp.name))
+        self.svc = DockerInfraService(host_root=Path(self._tmp.name))
         self.addCleanup(self._teardown_docker)
         # ensure_running builds the bundle image (slow on a cold cache) and
         # brings up the shared network + gateway + orchestrator.

tests/integration/test_orchestrator_docker_control_plane_auth.py

@@ -27,7 +27,7 @@ from pathlib import Path
 
 from bot_bottle.control_auth import ROLE_CLI, ROLE_GATEWAY, mint
 from bot_bottle.orchestrator.client import OrchestratorClient
-from bot_bottle.orchestrator.lifecycle import OrchestratorService
+from bot_bottle.backend.docker.infra import DockerInfraService
 from bot_bottle.paths import host_control_plane_token
 from tests._docker import skip_unless_docker
 
@@ -54,7 +54,7 @@ class TestDockerControlPlaneAuthIntegration(unittest.TestCase):
         cls.addClassCleanup(cls._tmp.cleanup)
 
         # host_control_plane_token() — both the token read below and the one
-        # OrchestratorService injects into the container's env — resolves its
+        # DockerInfraService injects into the container's env — resolves its
         # path via the *ambient* BOT_BOTTLE_ROOT env var, not the host_root
         # kwarg passed to the constructor (that kwarg only controls the DB
         # bind-mount destination). Without pointing the env var at the same
@@ -78,7 +78,7 @@ class TestDockerControlPlaneAuthIntegration(unittest.TestCase):
             cls._teardown_docker, infra_name, network, host_root
         )
 
-        cls.svc = OrchestratorService(
+        cls.svc = DockerInfraService(
             infra_name=infra_name,
             network=network,
             image=_TEST_INFRA_IMAGE,

tests/unit/test_backend_selection.py

@@ -390,10 +390,10 @@ class TestEnsureOrchestrator(unittest.TestCase):
     the orchestrator + gateway containers; firecracker boots the infra VM;
     macos-container starts the infra container."""
 
-    def test_docker_delegates_to_orchestrator_service(self):
+    def test_docker_delegates_to_infra_service(self):
         b = get_bottle_backend("docker")
         with patch(
-            "bot_bottle.orchestrator.lifecycle.OrchestratorService"
+            "bot_bottle.backend.docker.infra.DockerInfraService"
         ) as service_cls:
             service_cls.return_value.ensure_running.return_value = (
                 "http://127.0.0.1:8099"

tests/unit/test_docker_infra.py

@@ -9,20 +9,22 @@ from pathlib import Path
 from unittest.mock import MagicMock, Mock, patch
 
 from bot_bottle.gateway import GatewayError
-from bot_bottle.orchestrator.lifecycle import (
+from bot_bottle.backend.docker.infra import (
     INFRA_NAME,
     INFRA_SOURCE_HASH_LABEL,
-    OrchestratorService,
+    DockerInfraService,
+)
+from bot_bottle.orchestrator.lifecycle import (
     OrchestratorStartError,
     source_hash,
 )
 from bot_bottle.paths import GATEWAY_CA_DIRNAME
 from tests.unit import use_bottle_root
 
-_URLOPEN = "bot_bottle.orchestrator.lifecycle.urllib.request.urlopen"
-_RUN = "bot_bottle.orchestrator.lifecycle.run_docker"
-_SLEEP = "bot_bottle.orchestrator.lifecycle.time.sleep"
-_MONOTONIC = "bot_bottle.orchestrator.lifecycle.time.monotonic"
+_URLOPEN = "bot_bottle.backend.docker.infra.urllib.request.urlopen"
+_RUN = "bot_bottle.backend.docker.infra.run_docker"
+_SLEEP = "bot_bottle.backend.docker.infra.time.sleep"
+_MONOTONIC = "bot_bottle.backend.docker.infra.time.monotonic"
 
 
 def _health(status: int) -> MagicMock:
@@ -35,12 +37,12 @@ def _proc(returncode: int = 0, stdout: str = "", stderr: str = "") -> Mock:
     return Mock(returncode=returncode, stdout=stdout, stderr=stderr)
 
 
-class TestOrchestratorService(unittest.TestCase):
+class TestDockerInfraService(unittest.TestCase):
     def setUp(self) -> None:
         self._tmp = tempfile.TemporaryDirectory()
         self.addCleanup(self._tmp.cleanup)
         self.addCleanup(use_bottle_root(Path(self._tmp.name)))
-        self.svc = OrchestratorService(port=8099)
+        self.svc = DockerInfraService(port=8099)
 
     def test_url(self) -> None:
         self.assertEqual("http://127.0.0.1:8099", self.svc.url)
@@ -159,7 +161,7 @@ class TestOrchestratorService(unittest.TestCase):
                 return _proc(stdout="")
             return _proc()
 
-        svc = OrchestratorService(port=20001)
+        svc = DockerInfraService(port=20001)
         with patch(_URLOPEN, side_effect=[urllib.error.URLError("down"), _health(200)]), \
                 patch(_RUN, side_effect=fake), patch(_SLEEP):
             svc.ensure_running()

tests/unit/test_orchestrator_rotate_ca.py

@@ -9,7 +9,7 @@ from unittest.mock import Mock, patch
 
 from bot_bottle.orchestrator import rotate_ca
 from bot_bottle.gateway import GATEWAY_NAME
-from bot_bottle.orchestrator.lifecycle import INFRA_NAME
+from bot_bottle.backend.docker.infra import INFRA_NAME
 from bot_bottle.paths import host_gateway_ca_dir
 from tests.unit import use_bottle_root