refactor(gateway): macOS gateway under the Gateway service ABC

Extract the Apple-Container gateway data plane out of `MacosInfraService` into
`MacosGateway`, the macOS implementation of the shared `Gateway` service.
`connect_to_orchestrator(url, gateway_token)` runs the triple-homed gateway
container (egress + agent + control networks) carrying the mitmproxy CA and the
pre-minted `gateway` token; `address()` / `ca_cert_pem()` /
`provisioning_transport()` round out the contract.

The infra service now composes the gateway: `ensure_running` mints the
role-scoped `gateway` JWT (it holds the signing key; the gateway never does —
#469) and hands it to `gateway().connect_to_orchestrator(...)`, and
`ca_cert_pem` delegates to the service. The inlined `_ensure_gateway_container`
+ CA-read are gone. `AppleGatewayTransport` + the gateway container name/label
now live with the gateway module, breaking the old infra→provision coupling.

Splits the gateway-run + CA tests out of test_macos_infra into a dedicated
test_macos_gateway; the infra tests mock `svc.gateway`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/gateway_provision.py

@@ -9,15 +9,15 @@ CLI's equivalents against the infra container that hosts the gateway daemons.
 
 from __future__ import annotations
 
-from ..docker.gateway_provision import GatewayProvisionError
+from ...gateway import GatewayProvisionError
 from . import util as container_mod
-from .infra import INFRA_NAME
+from .gateway import GATEWAY_NAME
 
 
 class AppleGatewayTransport:
     """`GatewayTransport` for the gateway daemons in the Apple infra container."""
 
-    def __init__(self, gateway: str = INFRA_NAME) -> None:
+    def __init__(self, gateway: str = GATEWAY_NAME) -> None:
         self.gateway = gateway
 
     def exec(self, argv: list[str]) -> None: