refactor(firecracker): split the combined rootfs into per-plane artifacts

Each infra VM now boots its own rootfs instead of a shared combined image, so
the exposed gateway VM no longer carries buildah + the control-plane code it
never runs (a fatter, less-isolated exposed surface — the opposite of the plane
split's intent). The combined image bought only "one artifact"; each VM already
kept a full copy of the shared rootfs, so nothing was saved at boot.

  * orchestrator rootfs — control plane + buildah (Dockerfile.orchestrator.fc,
    FROM orchestrator); the slim gateway rootfs boots bot-bottle-gateway:latest
    directly. Dockerfile.infra.fc (the combined image) is deleted.
  * `_infra_init` splits into `_orchestrator_init` / `_gateway_init` (shared
    preamble via `_init_head`); each per-plane rootfs bakes only its role init,
    so the `bb_role` cmdline branch is gone.
  * infra_artifact is role-parametrized: a per-role package
    (bot-bottle-firecracker-<role>), version hash, URL, cache dir, and candidate
    subdir. `ensure_built` pulls both; `_expected_version` combines both markers.
  * publish_infra builds the images once, then builds + publishes an
    orchestrator and a gateway artifact under DIR/<role>/.

coverage.sh's candidate-dir plumbing is layout-agnostic (publish_infra --output
now fills DIR/<role>/, which ensure_artifact_gz reads). Full suite green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile.orchestrator.fc

@@ -0,0 +1,23 @@
+# Firecracker orchestrator-VM image (PRD 0070).
+#
+# The control-plane rootfs the orchestrator microVM boots: the lean orchestrator
+# image + the in-VM agent-image builder. The Firecracker backend builds users'
+# agent Dockerfiles *inside this VM* with buildah (rootless, daemonless) instead
+# of on the host — no host Docker daemon, no root-equivalent `docker` group. The
+# gateway VM boots a *separate*, slimmer rootfs (bot-bottle-gateway:latest) that
+# carries none of this build tooling — the exposed data plane stays minimal.
+#
+# `crun` is the OCI runtime; `netavark` + `aardvark-dns` are the network backend
+# for `FROM` pulls + `RUN` egress. `vfs` + `chroot`: buildah works as root in the
+# bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
+# base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
+# which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
+# Matches image_builder.
+FROM bot-bottle-orchestrator:latest
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      buildah crun netavark aardvark-dns \
+ && rm -rf /var/lib/apt/lists/*
+ENV STORAGE_DRIVER=vfs \
+    BUILDAH_ISOLATION=chroot