refactor(backend): generic setup/status; drop firecracker-only CLI

Add abstract `setup()`/`status()` classmethods to BottleBackend (same
per-host, no-instance shape as is_available) so host provisioning is
part of the backend contract, not a per-backend command. Replace the
`./cli.py firecracker {setup,status}` command with a generic
`./cli.py backend {setup,status} [--backend=NAME]` that resolves a
backend (flag / $BOT_BOTTLE_BACKEND / host default) and dispatches —
swapping backends is just a different --backend.

Implementations:
- firecracker: moved out of cli/ into backend/firecracker/setup.py
  (network pool module/script + range-overlap check), unchanged output.
- docker: new backend/docker/setup.py — reports docker on PATH, daemon
  reachability, and gVisor runsc; setup notes no privileged pool is
  needed. Minimal placeholder; richer version tracked in #345.
- macos-container: new setup.py — container CLI + system-service checks.

Also retarget the launch-preflight / isolation-probe pointers to the new
command. New test_cli_backend covers dispatch + docker setup/status.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/cli/__init__.py

@@ -1,6 +1,6 @@
 """Main CLI dispatcher.
 
-Commands: cleanup, commit, edit, info, init, list, resume, start, supervise
+Commands: backend, cleanup, commit, edit, info, init, list, resume, start, supervise
 """
 
 from __future__ import annotations
@@ -13,10 +13,10 @@ from ..manifest import ManifestError
 from ..store_manager import StoreManager
 from ._common import PROG
 from . import list as _list_mod
+from .backend import cmd_backend
 from .cleanup import cmd_cleanup
 from .commit import cmd_commit
 from .edit import cmd_edit
-from .firecracker import cmd_firecracker
 from .info import cmd_info
 from .init import cmd_init
 from .resume import cmd_resume
@@ -26,10 +26,10 @@ from .supervise import cmd_supervise
 cmd_list = _list_mod.cmd_list
 
 COMMANDS = {
+    "backend": cmd_backend,
     "cleanup": cmd_cleanup,
     "commit": cmd_commit,
     "edit": cmd_edit,
-    "firecracker": cmd_firecracker,
     "info": cmd_info,
     "init": cmd_init,
     "list": cmd_list,
@@ -42,10 +42,10 @@ COMMANDS = {
 def usage() -> None:
     sys.stderr.write(f"usage: {PROG} <command> [args...]\n\n")
     sys.stderr.write("Commands:\n")
+    sys.stderr.write("  backend   set up or check a backend's host prerequisites (setup|status)\n")
     sys.stderr.write("  cleanup   stop and remove all active bot-bottle containers\n")
     sys.stderr.write("  commit    snapshot a running bottle's container state to a Docker image\n")
     sys.stderr.write("  edit      open an agent in vim for editing\n")
-    sys.stderr.write("  firecracker  one-time network setup for the Firecracker backend\n")
     sys.stderr.write("  info      print env, skills, and prompt details for a named agent\n")
     sys.stderr.write("  init      interactively create a new agent and add it to bot-bottle.json\n")
     sys.stderr.write("  list      list available agents or active containers\n")

bot_bottle/cli/backend.py

@@ -0,0 +1,41 @@
+"""`backend` CLI command — generic host setup/status across backends.
+
+`./cli.py backend setup  [--backend=NAME]` provisions (or points at how
+to provision) the chosen backend's one-time host prerequisites.
+`./cli.py backend status [--backend=NAME]` reports readiness.
+
+Both dispatch to the backend's `setup()` / `status()` classmethods, so
+there are no backend-specific commands — swapping backends is just a
+different `--backend` (or `$BOT_BOTTLE_BACKEND`, or the host default).
+"""
+
+from __future__ import annotations
+
+import argparse
+
+from ..backend import get_bottle_backend, known_backend_names
+from ._common import PROG
+
+
+def cmd_backend(args: list[str]) -> int:
+    parser = argparse.ArgumentParser(
+        prog=f"{PROG} backend",
+        description="Set up or check a backend's host prerequisites.",
+    )
+    parser.add_argument(
+        "action",
+        choices=("setup", "status"),
+        help="setup: provision/print host prerequisites; status: report readiness",
+    )
+    parser.add_argument(
+        "--backend",
+        choices=known_backend_names(),
+        default=None,
+        help="backend to target (default: $BOT_BOTTLE_BACKEND or the host default)",
+    )
+    ns = parser.parse_args(args)
+
+    backend = get_bottle_backend(ns.backend)
+    if ns.action == "setup":
+        return backend.setup()
+    return backend.status()

bot_bottle/cli/firecracker.py

@@ -1,79 +0,0 @@
-"""`firecracker` CLI command — one-time network setup helper.
-
-`./cli.py firecracker setup` prints the host-appropriate config for the
-privileged, one-time network pool (TAP devices + isolation nftables
-table) the Firecracker backend needs. On NixOS it prints a declarative
-module to paste into your config (imperative rules don't survive
-nixos-rebuild); elsewhere it prints the sudo command for the bundled
-setup script. `./cli.py firecracker status` reports what's present.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-from ..backend.firecracker import netpool
-
-
-def _is_nixos() -> bool:
-    if Path("/etc/NIXOS").exists():
-        return True
-    try:
-        return "ID=nixos" in Path("/etc/os-release").read_text()
-    except OSError:
-        return False
-
-
-def _cmd_setup() -> int:
-    slots = netpool.all_slots()
-    sys.stderr.write(
-        f"Firecracker network pool: {len(slots)} slots "
-        f"({slots[0].iface}..{slots[-1].iface}), base {netpool.ip_base()}.\n"
-        f"This is a one-time privileged setup (needs root once).\n\n"
-    )
-    if _is_nixos():
-        sys.stderr.write(
-            "Detected NixOS. Paste this module into your configuration and "
-            "`nixos-rebuild switch` (imperative rules would not survive a "
-            "rebuild):\n\n"
-        )
-        sys.stdout.write(netpool.render_nixos_module())
-    else:
-        sys.stderr.write("Run the one-time setup as root:\n\n")
-        sys.stdout.write(netpool.render_shell_setup() + "\n")
-        sys.stderr.write(
-            "\n(On NixOS, use the declarative module instead — this host "
-            "was not detected as NixOS.)\n"
-        )
-    return 0
-
-
-def _cmd_status() -> int:
-    ok = True
-    if netpool.nft_table_present():
-        sys.stderr.write(f"nft table inet {netpool.NFT_TABLE}: present\n")
-    else:
-        sys.stderr.write(f"nft table inet {netpool.NFT_TABLE}: MISSING\n")
-        ok = False
-    missing = netpool.missing_taps()
-    total = netpool.pool_size()
-    if missing:
-        sys.stderr.write(f"TAP pool: {total - len(missing)}/{total} present "
-                         f"(missing: {', '.join(missing)})\n")
-        ok = False
-    else:
-        sys.stderr.write(f"TAP pool: {total}/{total} present\n")
-    if not ok:
-        sys.stderr.write("\nRun: ./cli.py firecracker setup\n")
-    return 0 if ok else 1
-
-
-def cmd_firecracker(args: list[str]) -> int:
-    sub = args[0] if args else ""
-    if sub == "setup":
-        return _cmd_setup()
-    if sub == "status":
-        return _cmd_status()
-    sys.stderr.write("usage: firecracker {setup|status}\n")
-    return 2