refactor(backend): generic setup/status; drop firecracker-only CLI

Add abstract `setup()`/`status()` classmethods to BottleBackend (same
per-host, no-instance shape as is_available) so host provisioning is
part of the backend contract, not a per-backend command. Replace the
`./cli.py firecracker {setup,status}` command with a generic
`./cli.py backend {setup,status} [--backend=NAME]` that resolves a
backend (flag / $BOT_BOTTLE_BACKEND / host default) and dispatches —
swapping backends is just a different --backend.

Implementations:
- firecracker: moved out of cli/ into backend/firecracker/setup.py
  (network pool module/script + range-overlap check), unchanged output.
- docker: new backend/docker/setup.py — reports docker on PATH, daemon
  reachability, and gVisor runsc; setup notes no privileged pool is
  needed. Minimal placeholder; richer version tracked in #345.
- macos-container: new setup.py — container CLI + system-service checks.

Also retarget the launch-preflight / isolation-probe pointers to the new
command. New test_cli_backend covers dispatch + docker setup/status.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/backend/docker/setup.py

@@ -0,0 +1,80 @@
+"""Host setup + status for the Docker backend.
+
+Unlike Firecracker, the Docker backend needs no privileged one-time
+host provisioning (no TAP pool / nft table) — networks and the sidecar
+bundle are created per-launch. So `setup()` is mostly an install/daemon
+pointer, and `status()` reports whether docker is usable.
+
+This is intentionally minimal; a richer version (daemon config checks,
+gVisor/runsc install guidance, rootless-docker hints) is tracked
+separately. Reached via `DockerBottleBackend.setup` / `.status`, which
+the generic `./cli.py backend {setup,status}` dispatches to.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+
+from . import util as _util
+
+
+def _docker_on_path() -> bool:
+    return shutil.which("docker") is not None
+
+
+def _daemon_reachable() -> bool:
+    if not _docker_on_path():
+        return False
+    return subprocess.run(
+        ["docker", "info"],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
+    ).returncode == 0
+
+
+def _print_install_pointer() -> None:
+    sys.stderr.write("Docker is required but was not found on PATH.\n")
+    sys.stderr.write("  macOS: Docker Desktop  https://docs.docker.com/desktop/install/mac-install/\n")
+    sys.stderr.write("  Linux: Docker Engine   https://docs.docker.com/engine/install/\n")
+
+
+def setup() -> int:
+    if not _docker_on_path():
+        _print_install_pointer()
+        return 1
+    sys.stderr.write(
+        "Docker backend: no privileged host setup required — networks and "
+        "the sidecar bundle are created per-launch.\n"
+    )
+    if not _daemon_reachable():
+        sys.stderr.write(
+            "The Docker daemon isn't reachable; start it (e.g. Docker "
+            "Desktop, or `systemctl start docker`).\n"
+        )
+        return 1
+    if not _util.runsc_available():
+        sys.stderr.write(
+            "Optional: register the gVisor (`runsc`) runtime with Docker for "
+            "a userspace syscall barrier; bottles auto-detect and use it.\n"
+        )
+    return 0
+
+
+def status() -> int:
+    ok = True
+    if _docker_on_path():
+        sys.stderr.write("docker on PATH: yes\n")
+    else:
+        sys.stderr.write("docker on PATH: NO\n")
+        ok = False
+    if ok and _daemon_reachable():
+        sys.stderr.write("docker daemon: reachable\n")
+    elif ok:
+        sys.stderr.write("docker daemon: UNREACHABLE\n")
+        ok = False
+    runsc = _docker_on_path() and _util.runsc_available()
+    sys.stderr.write(f"gVisor runsc runtime: {'registered' if runsc else 'not registered (optional)'}\n")
+    if not ok:
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=docker\n")
+    return 0 if ok else 1