feat(prd-0081): reprovision CA, git-gate, and egress tokens on gateway bring-up

On a Firecracker gateway cold boot, reconcile every live agent VM against
the fresh gateway: push the new mitmproxy CA into each agent's trust store,
re-provision git-gate repos/creds from the persisted upstreams snapshot,
and restore egress tokens. Per-bottle failures are logged and skipped so
one unreachable VM does not block the rest.

New modules / changes:
- backend/firecracker/reconcile.py: attach_bottled_agents_to_gateway,
  _push_ca, _reprovision_git_gate, _guest_ip_from_config
- git_gate/provision.py: write upstreams.json after key provisioning so
  the bring-up reconcile can reconstruct the upstream table without the
  manifest
- backend/firecracker/infra.py: call attach_bottled_agents_to_gateway in
  the cold-boot branch of ensure_running()
- backend/base.py: no-op default on BottleBackend
- backend/firecracker/consolidated_launch.py: remove superseded
  _reprovision_running_bottles / _guest_ip_from_config
- orchestrator: OrchestratorCore.update_agent_secret + POST
  /bottles/<id>/secret + client.update_agent_secret (single-secret
  in-place update, the reusable primitive from the 2026-07-26 hotfix)
- tests: 15 new tests in test_firecracker_reconcile.py; updated
  test_firecracker_infra.py cold-boot cases; stale FC reprovision tests
  removed from test_backend_secret_reprovision.py

Closes #516.

bot_bottle/backend/macos_container/gateway.py

@@ -84,7 +84,6 @@ class MacosGateway(Gateway):
         egress_network: str = GATEWAY_EGRESS_NETWORK,
         control_network: str = CONTROL_NETWORK,
         repo_root: Path | None = None,
-        local_build: bool = True,
     ) -> None:
         self.image_ref = image_ref
         self.name = name
@@ -94,7 +93,6 @@ class MacosGateway(Gateway):
         # Build context: the repo root in a checkout, a staged copy from the
         # installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        self._local_build = local_build
         # Set by `connect_to_orchestrator`: the URL the daemons resolve policy
         # against + the pre-minted `gateway` token they present. The gateway
         # never mints, so it never holds the signing key (#469).
@@ -103,11 +101,8 @@ class MacosGateway(Gateway):
 
     def ensure_built(self) -> None:
         """Build the data-plane image from `Dockerfile.gateway`."""
-        if self._local_build:
-            container_mod.build_image(
-                self.image_ref, str(self._repo_root), dockerfile="Dockerfile.gateway")
-        else:
-            container_mod.pull_image(self.image_ref)
+        container_mod.build_image(
+            self.image_ref, str(self._repo_root), dockerfile="Dockerfile.gateway")
 
     def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Bind the gateway to this orchestrator and (re)start it, dual-homed on

bot_bottle/backend/macos_container/infra.py

@@ -25,7 +25,6 @@ from __future__ import annotations
 from pathlib import Path
 
 from ... import resources
-from ... import release_manifest
 from ...orchestrator.lifecycle import (
     DEFAULT_PORT,
     DEFAULT_STARTUP_TIMEOUT_SECONDS,
@@ -87,14 +86,6 @@ class MacosInfraService(InfraService):
         self._orchestrator_name = orchestrator_name
         self._gateway_name = gateway_name
         self._db_volume = db_volume
-        resolved_orchestrator, orchestrator_local = release_manifest.oci_image(
-            "orchestrator", orchestrator_image)
-        resolved_gateway, gateway_local = release_manifest.oci_image(
-            "gateway", gateway_image)
-        self.orchestrator_image = resolved_orchestrator
-        self.gateway_image = resolved_gateway
-        self._orchestrator_local = orchestrator_local
-        self._gateway_local = gateway_local
 
     def orchestrator(self) -> MacosOrchestrator:
         """The control-plane service on the host-only control network. Cheap to
@@ -107,7 +98,6 @@ class MacosInfraService(InfraService):
             control_network=self.control_network,
             repo_root=self._repo_root,
             db_volume=self._db_volume,
-            local_build=self._orchestrator_local,
         )
 
     def gateway(self) -> MacosGateway:
@@ -122,7 +112,6 @@ class MacosInfraService(InfraService):
             egress_network=self.egress_network,
             control_network=self.control_network,
             repo_root=self._repo_root,
-            local_build=self._gateway_local,
         )
 
     def ensure_running(
@@ -138,8 +127,8 @@ class MacosInfraService(InfraService):
 
         orchestrator = self.orchestrator()
         gateway = self.gateway()
-        orchestrator.ensure_available()
-        gateway.ensure_available()
+        orchestrator.ensure_built()
+        gateway.ensure_built()
 
         orchestrator.ensure_running(startup_timeout=startup_timeout)
 

bot_bottle/backend/macos_container/launch.py

@@ -38,7 +38,6 @@ import subprocess
 from contextlib import ExitStack, contextmanager
 from typing import Callable, Generator
 
-from ...agent_provider import runtime_for
 from ...bottle_state import (
     egress_state_dir,
     git_gate_state_dir,
@@ -94,14 +93,7 @@ def _agent_image(plan: MacosContainerBottlePlan) -> str:
             )
         info(f"using cached agent image {plan.image!r}")
         return plan.image
-    if "@sha256:" in plan.image:
-        container_mod.pull_image(plan.image)
-        container_mod.verify_agent_image(
-            plan.image, runtime_for(plan.agent_provider_template).smoke_test,
-        )
-        return plan.image
-    container_mod.build_image(
-        plan.image, str(resources.build_root()), dockerfile=plan.dockerfile_path)
+    container_mod.build_image(plan.image, str(resources.build_root()), dockerfile=plan.dockerfile_path)
     return plan.image
 
 

bot_bottle/backend/macos_container/orchestrator.py

@@ -63,7 +63,6 @@ class MacosOrchestrator(Orchestrator):
         control_network: str = CONTROL_NETWORK,
         repo_root: Path | None = None,
         db_volume: str = ORCHESTRATOR_DB_VOLUME,
-        local_build: bool = True,
     ) -> None:
         self.image_ref = image_ref
         self.name = name
@@ -74,7 +73,6 @@ class MacosOrchestrator(Orchestrator):
         # staged copy from the installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
         self._db_volume = db_volume
-        self._local_build = local_build
 
     def url(self) -> str:
         """The orchestrator's control-network address (host CLI + registration),
@@ -116,12 +114,8 @@ class MacosOrchestrator(Orchestrator):
         """Build the control-plane image. The source is bind-mounted so a code
         change takes effect without a rebuild; the image still carries the
         package for its entrypoint."""
-        if self._local_build:
-            container_mod.build_image(
-                self.image_ref, str(self._repo_root),
-                dockerfile="Dockerfile.orchestrator")
-        else:
-            container_mod.pull_image(self.image_ref)
+        container_mod.build_image(
+            self.image_ref, str(self._repo_root), dockerfile="Dockerfile.orchestrator")
 
     def ensure_running(
         self, *, startup_timeout: float = DEFAULT_STARTUP_TIMEOUT_SECONDS,
@@ -152,6 +146,11 @@ class MacosOrchestrator(Orchestrator):
             "--dns", container_mod.dns_server(),
             # Container-only DB volume: exactly one kernel writes bot-bottle.db.
             "--volume", f"{self._db_volume}:{_DB_ROOT_IN_CONTAINER}",
+            # Live control-plane source (a code change takes effect on relaunch).
+            "--mount",
+            container_mod.bind_mount_spec(
+                str(self._repo_root), _SRC_IN_CONTAINER, readonly=True),
+            "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
             "--env", f"BOT_BOTTLE_ROOT={_DB_ROOT_IN_CONTAINER}",
             # Detect a real control-plane code change and recreate.
             "--env", f"BOT_BOTTLE_SOURCE_HASH={current_hash}",
@@ -162,14 +161,6 @@ class MacosOrchestrator(Orchestrator):
             # Dockerfile.orchestrator ENTRYPOINT is `-m bot_bottle.orchestrator`.
             "--host", "0.0.0.0", "--port", str(self.port), "--broker", "stub",
         ]
-        if self._local_build:
-            image_index = argv.index(self.image_ref)
-            argv[image_index:image_index] = [
-                "--mount",
-                container_mod.bind_mount_spec(
-                    str(self._repo_root), _SRC_IN_CONTAINER, readonly=True),
-                "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
-            ]
         result = container_mod.run_container_argv(
             argv, env={**os.environ, ORCHESTRATOR_TOKEN_ENV: _signing_key})
         if result.returncode != 0:

bot_bottle/backend/macos_container/util.py

@@ -101,19 +101,6 @@ def build_image(
     subprocess.run(args, check=True)
 
 
-def pull_image(ref: str) -> None:
-    """Acquire an immutable OCI reference through Apple Container."""
-    result = subprocess.run(
-        [_CONTAINER, "image", "pull", ref],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        raise RuntimeError(f"container image pull failed for {ref}: {detail}")
-
-
 def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
     """Run `argv` inside a throwaway container of a freshly built agent
     image and die loudly if it fails, instead of shipping an image