refactor(gateway): split data-plane files into egress/supervisor/git_gate services

Group the gateway's data-plane modules into three service sub-packages
mirroring the host-side trio (bot_bottle.egress / .supervisor / .git_gate):

  gateway/egress/     addon_core, addon, dlp_config, dlp_detectors
  gateway/supervisor/ server            (was supervise_server)
  gateway/git_gate/   render, http_backend

Prefix-stripped filenames now that the package namespaces them; each
sub-package has a thin docstring __init__ (no eager imports, cheap leaf
loads). The two cross-cutting files stay at the gateway root:
policy_resolver (shared per-client lookup) and gateway_init, renamed to
bootstrap now that gateway/ already namespaces it.

Updated all importers (bot_bottle + tests), the in-VM/container `-m`
launch strings, the Dockerfile.gateway addon shim + ENTRYPOINT, and the
five gateway entries in scripts/critical-modules.txt. Full unit suite
green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_egress.py

@@ -344,7 +344,7 @@ class TestRenderRoutes(unittest.TestCase):
         self.assertEqual([], parse_yaml_subset(rendered)["routes"])
 
     def test_round_trip_through_addon_core(self):
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         b = _bottle([
             {"host": "api.github.com",
              "auth": {"scheme": "Bearer", "token_ref": "GH_PAT"},
@@ -363,7 +363,7 @@ class TestRenderRoutes(unittest.TestCase):
         self.assertEqual("", addon_routes[2].auth_scheme)
 
     def test_dlp_round_trips(self):
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         b = _bottle([{"host": "x.example", "dlp": {
             "outbound_detectors": ["token_patterns"],
             "inbound_detectors": False,
@@ -375,7 +375,7 @@ class TestRenderRoutes(unittest.TestCase):
         self.assertEqual((), addon_routes[0].inbound_detectors)
 
     def test_outbound_on_match_round_trips(self):
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         b = _bottle([{"host": "logs.example", "dlp": {
             "outbound_on_match": "redact",
         }}])
@@ -392,7 +392,7 @@ class TestRenderRoutes(unittest.TestCase):
         self.assertNotIn("outbound_on_match", rendered)
 
     def test_git_fetch_policy_round_trips(self):
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         b = _bottle([{"host": "github.com", "git": {"fetch": True}}])
         routes = egress_routes_for_bottle(b)
         rendered = egress_render_routes(routes)
@@ -405,7 +405,7 @@ class TestRenderRoutes(unittest.TestCase):
         it, but the renderer in between dropped it — so the flag never reached
         the proxy and registry pulls kept failing with "unauthorized" while
         the config looked correct everywhere it was inspected."""
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         b = _bottle([{"host": "registry-1.docker.io", "preserve_auth": True}])
         routes = egress_routes_for_bottle(b)
         rendered = egress_render_routes(routes)
@@ -416,7 +416,7 @@ class TestRenderRoutes(unittest.TestCase):
         b = _bottle([{"host": "x.example"}])
         rendered = egress_render_routes(egress_routes_for_bottle(b))
         self.assertNotIn("preserve_auth", rendered)
-        from bot_bottle.gateway.egress_addon_core import load_config
+        from bot_bottle.gateway.egress.addon_core import load_config
         self.assertFalse(load_config(rendered).routes[0].preserve_auth)
 
     def test_log_zero_omitted_from_render(self):
@@ -434,7 +434,7 @@ class TestRenderRoutes(unittest.TestCase):
                 self.assertTrue(rendered.startswith(f"log: {level}\n"))
 
     def test_log_level_round_trips_to_addon_core(self):
-        from bot_bottle.gateway.egress_addon_core import load_config, LOG_FULL
+        from bot_bottle.gateway.egress.addon_core import load_config, LOG_FULL
         b = _bottle([{"host": "x.example"}])
         routes = egress_routes_for_bottle(b)
         rendered = egress_render_routes(routes, log=LOG_FULL)
@@ -444,7 +444,7 @@ class TestRenderRoutes(unittest.TestCase):
 
     def test_log_via_manifest_flows_to_render(self):
         from bot_bottle.manifest import ManifestIndex
-        from bot_bottle.gateway.egress_addon_core import load_config, LOG_BLOCKS
+        from bot_bottle.gateway.egress.addon_core import load_config, LOG_BLOCKS
         m = ManifestIndex.from_json_obj({
             "bottles": {"dev": {"egress": {
                 "log": 1,
@@ -512,7 +512,7 @@ class TestRenderRoutesEscaping(unittest.TestCase):
         self.assertEqual('Bear"er', parsed[0]["inspect"]["auth_scheme"])
 
     def test_path_value_with_double_quote_round_trips(self):
-        from bot_bottle.gateway.egress_addon_core import PathMatch, MatchEntry
+        from bot_bottle.gateway.egress.addon_core import PathMatch, MatchEntry
         routes = (EgressRoute(
             host="api.example",
             matches=(MatchEntry(paths=(PathMatch(type="prefix", value='/v1/"quoted"/'),)),),
@@ -521,7 +521,7 @@ class TestRenderRoutesEscaping(unittest.TestCase):
         self.assertEqual('/v1/"quoted"/', parsed[0]["inspect"]["matches"][0]["paths"][0]["value"])
 
     def test_header_value_with_double_quote_round_trips(self):
-        from bot_bottle.gateway.egress_addon_core import HeaderMatch, MatchEntry
+        from bot_bottle.gateway.egress.addon_core import HeaderMatch, MatchEntry
         routes = (EgressRoute(
             host="api.example",
             matches=(MatchEntry(headers=(HeaderMatch(name="x-h", value='val"ue'),)),),
@@ -598,7 +598,7 @@ class TestCanaryGeneration(unittest.TestCase):
         self.assertNotEqual(plan_a.canary, plan_b.canary)
 
     def test_canary_detected_by_scan_known_secrets(self):
-        from bot_bottle.gateway.dlp_detectors import scan_known_secrets
+        from bot_bottle.gateway.egress.dlp_detectors import scan_known_secrets
 
         plan = self._make_plan()
         env = {plan.canary_env: plan.canary}