refactor(gateway): parameterize git-gate provisioning transport (Stage B prep)

git-gate provisioning into the running gateway was hard-wired to docker
exec/cp. Extract a backend-neutral `GatewayTransport` (exec + cp_into) so
the same provisioning logic serves both the docker gateway container and
the firecracker gateway VM (over SSH, added with the launch swap).

- `provision_git_gate` / `deprovision_git_gate` now take a transport
  instead of a gateway name; `DockerGatewayTransport` wraps the existing
  docker exec/cp behavior. deprovision is best-effort (catches the
  transport error) — matching the prior idempotent teardown.
- both consolidated_launch callers pass `DockerGatewayTransport(name)` —
  no behavior change; the firecracker swap flips only its own to SSH.

Pure refactor: docker path unchanged, gateway_provision tests updated to
construct the transport, all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_gateway_provision.py

@@ -8,6 +8,7 @@ from unittest.mock import Mock, patch
 
 from bot_bottle.backend.docker.gateway_provision import (
     GatewayProvisionError,
+    DockerGatewayTransport,
     deprovision_git_gate,
     provision_git_gate,
 )
@@ -54,7 +55,7 @@ class TestProvisionGitGate(unittest.TestCase):
     def test_copies_creds_and_runs_namespaced_init(self) -> None:
         calls: list[list[str]] = []
         with patch(_RUN, side_effect=_recorder(calls)):
-            provision_git_gate("gw", "bottle1", _plan(_up("foo", known_hosts="/host/kh")))
+            provision_git_gate(DockerGatewayTransport("gw"), "bottle1", _plan(_up("foo", known_hosts="/host/kh")))
 
         cps = [c for c in calls if c[:2] == ["docker", "cp"]]
         self.assertIn(["docker", "cp", "/host/keys/id", "gw:/git-gate/creds/bottle1/foo-key"], cps)
@@ -71,32 +72,32 @@ class TestProvisionGitGate(unittest.TestCase):
     def test_omits_known_hosts_copy_when_absent(self) -> None:
         calls: list[list[str]] = []
         with patch(_RUN, side_effect=_recorder(calls)):
-            provision_git_gate("gw", "b1", _plan(_up("foo")))  # no known_hosts
+            provision_git_gate(DockerGatewayTransport("gw"), "b1", _plan(_up("foo")))  # no known_hosts
         creds_cps = [c for c in calls if c[:2] == ["docker", "cp"] and "/git-gate/creds/" in c[3]]
         self.assertEqual(1, len(creds_cps))  # only the key, not known_hosts
         self.assertTrue(creds_cps[0][3].endswith("/foo-key"))
 
     def test_no_upstreams_is_noop(self) -> None:
         with patch(_RUN) as m:
-            provision_git_gate("gw", "b1", _plan())
+            provision_git_gate(DockerGatewayTransport("gw"), "b1", _plan())
         m.assert_not_called()
 
     def test_raises_on_docker_failure(self) -> None:
         with patch(_RUN, return_value=_proc(returncode=1, stderr="boom")):
             with self.assertRaises(GatewayProvisionError):
-                provision_git_gate("gw", "b1", _plan(_up("foo")))
+                provision_git_gate(DockerGatewayTransport("gw"), "b1", _plan(_up("foo")))
 
     def test_rejects_unsafe_bottle_id_before_any_docker(self) -> None:
         with patch(_RUN) as m:
             with self.assertRaises(GatewayProvisionError):
-                provision_git_gate("gw", "../etc", _plan(_up("foo")))
+                provision_git_gate(DockerGatewayTransport("gw"), "../etc", _plan(_up("foo")))
         m.assert_not_called()  # rejected before a single docker call
 
 
 class TestDeprovision(unittest.TestCase):
     def test_removes_repo_and_creds(self) -> None:
         with patch(_RUN, return_value=_proc()) as m:
-            deprovision_git_gate("gw", "b1")
+            deprovision_git_gate(DockerGatewayTransport("gw"), "b1")
         argv = m.call_args.args[0]
         self.assertEqual(["docker", "exec", "gw", "rm", "-rf"], argv[:5])
         self.assertIn("/git/b1", argv)
@@ -105,7 +106,7 @@ class TestDeprovision(unittest.TestCase):
     def test_rejects_unsafe_bottle_id(self) -> None:
         with patch(_RUN) as m:
             with self.assertRaises(GatewayProvisionError):
-                deprovision_git_gate("gw", "a/b")
+                deprovision_git_gate(DockerGatewayTransport("gw"), "a/b")
         m.assert_not_called()