refactor: remove leftovers from the orchestrator/gateway consolidation

Sweep for vestiges of the old combined-plane model and the pre-split shared
rootfs. Two are load-bearing, the rest are stale docs/comments:

- Bug: macOS `enumerate_active` only excluded the gateway container from the
  agent list, so after the split the orchestrator container
  (`bot-bottle-mac-orchestrator`, also `bot-bottle-`-prefixed) was enumerated as
  a phantom agent. Exclude both infra containers; test covers it.
- Dead code: the gateway `bootstrap.py` still carried an `orchestrator` daemon
  spec + `_OPT_IN_DAEMONS` + a signing-key/JWT env branch, all for the old
  combined container where the gateway process could also run the control plane.
  No backend ever requests it now — removed; the key-stripping stays as
  defense-in-depth.

Stale-comment reframes: "the/single infra container" -> the orchestrator +
gateway pair (or the specific plane); "shared rootfs / bb_role init / one
published rootfs" -> the per-plane rootfs + `role_init`; the deleted
Dockerfile.infra references in Dockerfile.orchestrator/.gateway; and the macOS
"one infra container ... same address" docstring + its now-false
share-one-address test (the planes are distinct containers with distinct
addresses).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_gateway_init.py

@@ -64,11 +64,11 @@ class TestEnvForDaemon(unittest.TestCase):
         self.assertNotIn("X", self._BASE)
 
 
-class TestOrchestratorEnvScoping(unittest.TestCase):
-    """The control-plane signing key stays with the orchestrator; the pre-minted
-    `gateway` JWT goes to the data-plane daemons (issue #469 review). Scoping
-    them per-process keeps a compromised data-plane daemon from reading the key
-    and minting a higher-privilege token, even in the combined infra container."""
+class TestSigningKeyScoping(unittest.TestCase):
+    """The gateway never holds the control-plane signing key — it's the
+    orchestrator's, which runs in a separate container/VM. Its daemons present
+    the pre-minted `gateway` JWT instead; the key is stripped from every daemon's
+    env as defense-in-depth (issue #469 review)."""
 
     _BASE = {
         "PATH": "/usr/bin",
@@ -76,11 +76,6 @@ class TestOrchestratorEnvScoping(unittest.TestCase):
         "BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT": "gw-jwt",
     }
 
-    def test_orchestrator_gets_key_not_jwt(self):
-        env = _env_for_daemon("orchestrator", self._BASE)
-        self.assertEqual("sk-x", env["BOT_BOTTLE_ORCHESTRATOR_TOKEN"])
-        self.assertNotIn("BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT", env)
-
     def test_data_plane_daemons_get_jwt_not_key(self):
         for name in ("egress", "git-gate", "git-http", "supervise"):
             env = _env_for_daemon(name, self._BASE)

tests/unit/test_macos_consolidated_launch.py

@@ -57,9 +57,11 @@ class TestEnsureGateway(unittest.TestCase):
     def _service(self) -> MagicMock:
         from bot_bottle.backend.macos_container.infra import InfraEndpoint
         service = MagicMock()
+        # Two containers now: the orchestrator on the control network, the
+        # gateway on the agent network — distinct addresses.
         service.ensure_running.return_value = InfraEndpoint(
             orchestrator_url="http://192.168.128.2:8099",
-            gateway_ip="192.168.128.2",
+            gateway_ip="192.168.128.3",
         )
         service.network = "bot-bottle-mac-gateway"
         service.ca_cert_pem.return_value = "PEM"
@@ -68,18 +70,16 @@ class TestEnsureGateway(unittest.TestCase):
     def test_reports_gateway_endpoint(self) -> None:
         endpoint = self._run(self._service())
         self.assertEqual("http://192.168.128.2:8099", endpoint.orchestrator_url)
-        self.assertEqual("192.168.128.2", endpoint.gateway_ip)
+        self.assertEqual("192.168.128.3", endpoint.gateway_ip)
         self.assertEqual("PEM", endpoint.gateway_ca_pem)
         self.assertEqual("bot-bottle-mac-gateway", endpoint.network)
 
-    def test_orchestrator_and_gateway_share_one_address(self) -> None:
-        """One infra container hosts both, so the gateway IP and the
-        control-plane host are the same."""
+    def test_gateway_ip_is_distinct_from_the_control_plane(self) -> None:
+        # The planes are separate containers, so the agent's proxy target (the
+        # gateway) is a different address from the control-plane host.
         endpoint = self._run(self._service())
-        self.assertEqual(
-            endpoint.gateway_ip,
-            endpoint.orchestrator_url.split("://")[1].split(":")[0],
-        )
+        orch_host = endpoint.orchestrator_url.split("://")[1].split(":")[0]
+        self.assertNotEqual(orch_host, endpoint.gateway_ip)
 
 
 class TestRegisterAgent(unittest.TestCase):

tests/unit/test_macos_container_cleanup.py

@@ -60,10 +60,12 @@ class TestMacosContainerEnumerate(unittest.TestCase):
         self.assertEqual(["dev-abc"], [a.slug for a in agents])
         self.assertEqual(["macos-container"], [a.backend_name for a in agents])
 
-    def test_excludes_the_infra_singleton(self):
-        """The infra container shares the bot-bottle- prefix but is
-        infrastructure — listing it would invent an agent per host."""
-        agents = self._enumerate("bot-bottle-mac-infra\nbot-bottle-dev-abc\n")
+    def test_excludes_both_infra_containers(self):
+        """Both infra containers (orchestrator + gateway) share the bot-bottle-
+        prefix but are infrastructure — listing either would invent a phantom
+        agent per host."""
+        agents = self._enumerate(
+            "bot-bottle-mac-infra\nbot-bottle-mac-orchestrator\nbot-bottle-dev-abc\n")
         self.assertEqual(["dev-abc"], [a.slug for a in agents])
 
     def test_raises_when_the_cli_fails(self):