refactor(orchestrator): introduce the Orchestrator service ABC (docker impl)

Mirror the Gateway work for the control plane. Add the backend-neutral
`Orchestrator` service ABC in orchestrator/lifecycle.py — build the image/rootfs,
`ensure_running` (start + health-gate), `is_running`/`is_healthy`/`stop`,
`url()` (host-facing) vs `gateway_url()` (what the gateway resolves against),
and a concrete `mint_gateway_token()` (the orchestrator holds the signing key,
so it issues the gateway's token — #469).

`DockerOrchestrator` (backend/docker/orchestrator.py) is the first impl,
extracted out of `DockerInfraService`: the control-plane container run, the
`--internal` control network, the source-hash recreate gate, health polling,
and the orchestrator constants (name/label/network/image/dockerfile/hash-label).
`DockerInfraService` now composes `orchestrator()` + `gateway()` — each builds
its own image via `ensure_built`, the orchestrator comes up first, then the
gateway is connected with the orchestrator-minted token. Its `url`/`is_healthy`
delegate to the orchestrator service.

Split the container-lifecycle tests into test_docker_orchestrator; test_docker_infra
now covers the composition. macOS + firecracker follow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/__init__.py

@@ -42,6 +42,7 @@ if TYPE_CHECKING:
     )
     from .docker_broker import DockerBroker, DockerBrokerError
     from ..gateway import Gateway, GatewayError
+    from .lifecycle import Orchestrator
     from .service import OrchestratorCore
     from .server import OrchestratorServer, dispatch, make_server
 
@@ -64,6 +65,7 @@ _LAZY: dict[str, str] = {
     "DockerBrokerError": ".docker_broker",
     "Gateway": "..gateway",
     "GatewayError": "..gateway",
+    "Orchestrator": ".lifecycle",
     "OrchestratorCore": ".service",
     "OrchestratorServer": ".server",
     "dispatch": ".server",
@@ -96,6 +98,7 @@ __all__ = [
     "DockerBrokerError",
     "Gateway",
     "GatewayError",
+    "Orchestrator",
     "OrchestratorCore",
     "OrchestratorServer",
     "dispatch",