feat(backend): reconcile running bottles' CA on gateway bring-up (0081)

Add `attach_bottled_agents_to_gateway()` as an `@abc.abstractmethod` on
`BottleBackend` and implement the first reconcile step across all three
backends: on a gateway cold boot, replace every already-running agent's
trusted CA with the freshly-minted gateway CA. Reconciling running bottles
is a backend responsibility (only the backend can enumerate its agents and
reach them — firecracker over SSH, docker/macOS over exec/cp), so making it
an abstract method keeps the fix cross-backend by construction.

The gateway rootfs is ephemeral, so a rebuild mints a new CA that every
running bottle distrusts (SSL verification fails — #510). This reconcile is
what distributes the fresh CA, so a routine gateway rebuild now doubles as a
free CA rotation. Per-bottle steps are best-effort: one unreachable or
malformed bottle is logged and skipped, never blocking the others.

Trigger — `Gateway.connect_to_orchestrator` now returns a cold-boot bool
(True when it actually (re)brought the gateway up, False when a healthy
current gateway was left untouched); each infra `ensure_running` gates the
reconcile on it, so it fires exactly on cold boot and never on an adopt.

Git-gate re-provision and egress-token restore fold into this same reconcile
on the same trigger in follow-up PRs (#516).

Refs #516. Addresses #510.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_macos_gateway.py

@@ -44,6 +44,17 @@ class TestMacosGatewayConnect(unittest.TestCase):
     def test_default_name(self) -> None:
         self.assertEqual(GATEWAY_NAME, self.gw.name)
 
+    def test_connect_signals_cold_boot(self) -> None:
+        # The container is recreated unconditionally, so connect always signals
+        # a cold boot → the caller reconciles running bottles (PRD 0081).
+        run = Mock(return_value=_proc())
+        with patch(f"{_GW}.container_mod") as mod, \
+                patch(f"{_GW}.host_gateway_ca_dir", return_value=Path("/ca")):
+            mod.dns_server.return_value = "1.1.1.1"
+            mod.bind_mount_spec.side_effect = _spec
+            mod.run_container_argv = run
+            self.assertTrue(self.gw.connect_to_orchestrator(_ORCH_URL, _TOKEN))
+
     def test_refuses_without_orchestrator_url(self) -> None:
         with patch(f"{_GW}.container_mod") as mod:
             with self.assertRaises(GatewayError):