feat(orchestrator): add buildah for in-VM agent-image builds (PRD 0069 Stage 3)

The Firecracker backend's remaining host-Docker dependency is building
users' agent Dockerfiles. Move that build *into the orchestrator VM*:
give the orchestrator image buildah (rootless, daemonless) so it builds
agent images itself, and the host needs no Docker daemon and no
root-equivalent `docker` group. An untrusted Dockerfile then builds
inside the confined orchestrator VM rather than on the host — strictly
more isolated than host `docker build`.

- buildah + crun (OCI runtime) + netavark/aardvark-dns (network backend
  for FROM pulls and RUN egress), installed explicitly since
  --no-install-recommends strips buildah's helper deps.
- vfs storage + chroot isolation (STORAGE_DRIVER/BUILDAH_ISOLATION) so
  buildah needs neither fuse-overlayfs / an overlay kernel module nor
  configured subuid maps — it works unconditionally as root in a minimal
  microVM rootfs. (Slower than overlay; a build-cache pass is deferred.)

Bootstrap: the orchestrator rootfs is still produced from this image via
host docker export; a later step pulls a pre-built image instead.

Verified: the orchestrator image boots as a Firecracker VM and buildah
runs inside it as real VM root (reaches the base-image pull; build-time
egress wiring is the next step).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

Dockerfile.orchestrator

@@ -1,9 +1,10 @@
-# Orchestrator control-plane image (PRD 0070, #384).
+# Orchestrator control-plane image (PRD 0070, #384) + in-VM agent-image
+# builder (PRD 0069 Stage 3).
 #
 # The per-host orchestrator runs `python3 -m bot_bottle.orchestrator`.
 # The `bot_bottle` package is **stdlib-only** by design, so the control
-# plane needs nothing but a Python runtime — none of the gateway's
-# mitmproxy / git / gitleaks payload (that is the separate
+# plane itself needs nothing but a Python runtime — none of the
+# gateway's mitmproxy / git / gitleaks payload (that is the separate
 # `bot-bottle-gateway` image, Dockerfile.gateway). Splitting them keeps
 # the secret-dense control plane (it concentrates every bottle's egress
 # tokens — see PRD 0070's "secret concentration") on a minimal
@@ -17,9 +18,35 @@
 
 FROM python:3.12-slim
 
-# No third-party deps to install — stdlib only. Kept as an explicit,
-# self-documenting stage so a future confinement step (baking the
-# package, dropping the bind mount) has an obvious home.
+# --- in-VM agent-image builder (PRD 0069 Stage 3) -------------------
+# The Firecracker backend removes the host Docker daemon by building
+# users' agent Dockerfiles *inside the orchestrator VM* with buildah
+# (rootless, daemonless) instead of on the host. The host then needs no
+# Docker daemon and no root-equivalent `docker` group; an untrusted
+# Dockerfile builds inside the confined orchestrator VM, never on the
+# host — strictly more isolated than host `docker build`.
+#
+# `git` lets buildah resolve git-context builds and lets the backend
+# clone/pull; `ca-certificates` is needed for `FROM` pulls over TLS.
+# buildah's runtime helpers (stripped by --no-install-recommends, so
+# listed explicitly): `crun` is the OCI runtime that executes build
+# steps; `netavark` + `aardvark-dns` are the network backend buildah
+# uses to give `FROM` pulls and `RUN` steps network access.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      buildah crun netavark aardvark-dns git ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# vfs storage + chroot isolation: buildah then needs neither
+# fuse-overlayfs / an overlay kernel module nor configured subuid maps
+# (newuidmap/newgidmap), so it works unconditionally as root in a
+# minimal microVM rootfs. vfs copies layers rather than stacking them —
+# slower and heavier than overlay; a build-cache optimization (overlay
+# where available, a persistent cache disk) is tracked for later.
+ENV STORAGE_DRIVER=vfs \
+    BUILDAH_ISOLATION=chroot
+
+# No third-party *Python* deps — the control plane stays stdlib only.
 WORKDIR /app
 
 # Documentation only; lifecycle.py overrides the entrypoint to