refactor(orchestrator): swap SubprocessBottleRunner → ProgrammaticBottleRunner

BottleRunner Protocol tightened: start() → str, freeze/resume/destroy → None.
RunResult removed. lifecycle.py unpacks the slug directly. FakeRunner and
test_runner updated to match. Config.bot_bottle_cli dropped (nothing uses it).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bot_bottle/orchestrator/bootstrap.py

@@ -22,7 +22,7 @@ from ..contrib.gitea.forge_state import ForgeState, SqliteForgeStateStore
 from .config import Config
 from .lifecycle import Orchestrator
 from .model import RunRecord
-from .runner import SubprocessBottleRunner
+from .runner import ProgrammaticBottleRunner
 from .sidecar import ForgeSidecar, OpLog, drain_done_events
 from .watchdog import Watchdog
 from .webhook import WebhookServer
@@ -104,7 +104,7 @@ def make_sidecar(
 
 def build(config: Config) -> tuple[WebhookServer, Watchdog, Orchestrator]:
     store = BotBottleStateStore(config.db_path)
-    runner = SubprocessBottleRunner(cli=config.bot_bottle_cli, base_env=dict(os.environ))
+    runner = ProgrammaticBottleRunner()
     membership_forge = make_forge(config, "_", "_")
     orchestrator = Orchestrator(
         forge=membership_forge,