feat(prd-0081): reprovision CA, git-gate, and egress tokens on gateway bring-up

On a Firecracker gateway cold boot, reconcile every live agent VM against
the fresh gateway: push the new mitmproxy CA into each agent's trust store,
re-provision git-gate repos/creds from the persisted upstreams snapshot,
and restore egress tokens. Per-bottle failures are logged and skipped so
one unreachable VM does not block the rest.

New modules / changes:
- backend/firecracker/reconcile.py: attach_bottled_agents_to_gateway,
  _push_ca, _reprovision_git_gate, _guest_ip_from_config
- git_gate/provision.py: write upstreams.json after key provisioning so
  the bring-up reconcile can reconstruct the upstream table without the
  manifest
- backend/firecracker/infra.py: call attach_bottled_agents_to_gateway in
  the cold-boot branch of ensure_running()
- backend/base.py: no-op default on BottleBackend
- backend/firecracker/consolidated_launch.py: remove superseded
  _reprovision_running_bottles / _guest_ip_from_config
- orchestrator: OrchestratorCore.update_agent_secret + POST
  /bottles/<id>/secret + client.update_agent_secret (single-secret
  in-place update, the reusable primitive from the 2026-07-26 hotfix)
- tests: 15 new tests in test_firecracker_reconcile.py; updated
  test_firecracker_infra.py cold-boot cases; stale FC reprovision tests
  removed from test_backend_secret_reprovision.py

Closes #516.

tests/unit/test_docker_infra.py

@@ -46,8 +46,8 @@ class TestDockerInfraService(unittest.TestCase):
         url = self.svc.ensure_running()
         self.assertEqual("http://127.0.0.1:8099", url)
         # Both images built; the control plane comes up before the gateway.
-        self.orch.ensure_available.assert_called_once()
-        self.gw.ensure_available.assert_called_once()
+        self.orch.ensure_built.assert_called_once()
+        self.gw.ensure_built.assert_called_once()
         self.orch.ensure_running.assert_called_once()
 
     def test_ensure_running_connects_gateway_with_minted_token(self) -> None:
@@ -76,19 +76,6 @@ class TestDockerInfraService(unittest.TestCase):
         self.assertEqual("registry-volume", svc.orchestrator()._root_mount_source)
         self.assertEqual("ca-volume", svc.gateway()._ca_mount_source)
 
-    def test_packaged_images_disable_local_infra_dockerfiles(self) -> None:
-        refs = [
-            ("registry/orchestrator@sha256:" + "a" * 64, False),
-            ("registry/gateway@sha256:" + "b" * 64, False),
-        ]
-        with patch(
-            "bot_bottle.backend.docker.infra.release_manifest.oci_image",
-            side_effect=refs,
-        ):
-            svc = DockerInfraService()
-        self.assertIsNone(svc.orchestrator()._dockerfile)
-        self.assertIsNone(svc.gateway()._dockerfile)
-
     def test_host_path_and_named_root_mount_are_mutually_exclusive(self) -> None:
         with self.assertRaisesRegex(ValueError, "host_root or root_mount_source"):
             DockerInfraService(