refactor(gateway): split data-plane files into egress/supervisor/git_gate services

Group the gateway's data-plane modules into three service sub-packages
mirroring the host-side trio (bot_bottle.egress / .supervisor / .git_gate):

  gateway/egress/     addon_core, addon, dlp_config, dlp_detectors
  gateway/supervisor/ server            (was supervise_server)
  gateway/git_gate/   render, http_backend

Prefix-stripped filenames now that the package namespaces them; each
sub-package has a thin docstring __init__ (no eager imports, cheap leaf
loads). The two cross-cutting files stay at the gateway root:
policy_resolver (shared per-client lookup) and gateway_init, renamed to
bootstrap now that gateway/ already namespaces it.

Updated all importers (bot_bottle + tests), the in-VM/container `-m`
launch strings, the Dockerfile.gateway addon shim + ENTRYPOINT, and the
five gateway entries in scripts/critical-modules.txt. Full unit suite
green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_dlp_detectors.py

@@ -7,7 +7,7 @@ import base64
 import gzip
 import unittest
 
-from bot_bottle.gateway.dlp_detectors import (
+from bot_bottle.gateway.egress.dlp_detectors import (
     ENTROPY_BLOCK_THRESHOLD,
     PARTIAL_MATCH_MIN_LEN,
     REDACT,
@@ -465,17 +465,17 @@ class TestMatchedAndSafeTokens(unittest.TestCase):
 
 class TestStripCrlf(unittest.TestCase):
     def test_removes_url_encoded_crlf(self):
-        from bot_bottle.gateway.dlp_detectors import strip_crlf
+        from bot_bottle.gateway.egress.dlp_detectors import strip_crlf
         out = strip_crlf("next=%0d%0aX-Injected: evil")
         self.assertNotRegex(out, r"%0[dD]%0[aA]")
 
     def test_removes_literal_header_injection(self):
-        from bot_bottle.gateway.dlp_detectors import strip_crlf
+        from bot_bottle.gateway.egress.dlp_detectors import strip_crlf
         out = strip_crlf("value\r\nX-Injected: evil")
         self.assertIsNone(scan_crlf_injection(out))
 
     def test_leaves_clean_text_unchanged(self):
-        from bot_bottle.gateway.dlp_detectors import strip_crlf
+        from bot_bottle.gateway.egress.dlp_detectors import strip_crlf
         self.assertEqual("/api/v1/data?q=hello", strip_crlf("/api/v1/data?q=hello"))
 
 class TestAlnumProjection(unittest.TestCase):