refactor: unify component naming — control_plane/control_auth -> orchestrator

The codebase used "control plane" both as an architectural role term AND
as an identifier alias for the orchestrator component, producing
duplicate names for one thing (control_plane_url vs orchestrator_url,
CONTROL_PLANE_PORT, host_control_plane_token, …). Going forward the
concrete component is always named for what it is — Gateway or
Orchestrator — and the plane vocabulary is reserved for prose (module
descriptions, the security argument).

Renamed (identifiers + the in-repo env/wire/file string values, all
setters/getters are in this repo so the change is atomic):

  ControlPlaneServer            -> OrchestratorServer
  control_plane_url             -> orchestrator_url
  probe_control_plane_url       -> probe_orchestrator_url
  host_control_plane_token      -> host_orchestrator_token
  CONTROL_PLANE_PORT            -> ORCHESTRATOR_PORT
  CONTROL_PLANE_TOKEN_ENV/FILE  -> ORCHESTRATOR_TOKEN_ENV/FILENAME
  BOT_BOTTLE_CONTROL_PLANE_TOKEN-> BOT_BOTTLE_ORCHESTRATOR_TOKEN
  control-plane-token (file)    -> orchestrator-token

  control_auth (module)         -> orchestrator_auth  (stays top-level;
                                   the gateway imports it and must not
                                   import the orchestrator/ package)
  CONTROL_AUTH_HEADER           -> ORCHESTRATOR_AUTH_HEADER
  x-bot-bottle-control-auth     -> x-bot-bottle-orchestrator-auth
  CONTROL_AUTH_JWT_ENV          -> ORCHESTRATOR_AUTH_JWT_ENV
  BOT_BOTTLE_CONTROL_AUTH_JWT   -> BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT
  _control_auth_headers         -> _orchestrator_auth_headers

Prose plane-terms ("control plane", "data plane") are preserved,
including the test name test_data_plane_daemons_get_jwt_not_key (it
names the security invariant). Gateway and orchestrator verified to
agree on the renamed wire header; full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_gateway_init.py

@@ -64,7 +64,7 @@ class TestEnvForDaemon(unittest.TestCase):
         self.assertNotIn("X", self._BASE)
 
 
-class TestControlPlaneEnvScoping(unittest.TestCase):
+class TestOrchestratorEnvScoping(unittest.TestCase):
     """The control-plane signing key stays with the orchestrator; the pre-minted
     `gateway` JWT goes to the data-plane daemons (issue #469 review). Scoping
     them per-process keeps a compromised data-plane daemon from reading the key
@@ -72,20 +72,20 @@ class TestControlPlaneEnvScoping(unittest.TestCase):
 
     _BASE = {
         "PATH": "/usr/bin",
-        "BOT_BOTTLE_CONTROL_PLANE_TOKEN": "sk-x",
-        "BOT_BOTTLE_CONTROL_AUTH_JWT": "gw-jwt",
+        "BOT_BOTTLE_ORCHESTRATOR_TOKEN": "sk-x",
+        "BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT": "gw-jwt",
     }
 
     def test_orchestrator_gets_key_not_jwt(self):
         env = _env_for_daemon("orchestrator", self._BASE)
-        self.assertEqual("sk-x", env["BOT_BOTTLE_CONTROL_PLANE_TOKEN"])
-        self.assertNotIn("BOT_BOTTLE_CONTROL_AUTH_JWT", env)
+        self.assertEqual("sk-x", env["BOT_BOTTLE_ORCHESTRATOR_TOKEN"])
+        self.assertNotIn("BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT", env)
 
     def test_data_plane_daemons_get_jwt_not_key(self):
         for name in ("egress", "git-gate", "git-http", "supervise"):
             env = _env_for_daemon(name, self._BASE)
-            self.assertNotIn("BOT_BOTTLE_CONTROL_PLANE_TOKEN", env, name)
-            self.assertEqual("gw-jwt", env["BOT_BOTTLE_CONTROL_AUTH_JWT"], name)
+            self.assertNotIn("BOT_BOTTLE_ORCHESTRATOR_TOKEN", env, name)
+            self.assertEqual("gw-jwt", env["BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT"], name)
 
 
 class TestSelectedDaemons(unittest.TestCase):