feat(prd-0081): reprovision CA, git-gate, and egress tokens on gateway bring-up

On a Firecracker gateway cold boot, reconcile every live agent VM against
the fresh gateway: push the new mitmproxy CA into each agent's trust store,
re-provision git-gate repos/creds from the persisted upstreams snapshot,
and restore egress tokens. Per-bottle failures are logged and skipped so
one unreachable VM does not block the rest.

New modules / changes:
- backend/firecracker/reconcile.py: attach_bottled_agents_to_gateway,
  _push_ca, _reprovision_git_gate, _guest_ip_from_config
- git_gate/provision.py: write upstreams.json after key provisioning so
  the bring-up reconcile can reconstruct the upstream table without the
  manifest
- backend/firecracker/infra.py: call attach_bottled_agents_to_gateway in
  the cold-boot branch of ensure_running()
- backend/base.py: no-op default on BottleBackend
- backend/firecracker/consolidated_launch.py: remove superseded
  _reprovision_running_bottles / _guest_ip_from_config
- orchestrator: OrchestratorCore.update_agent_secret + POST
  /bottles/<id>/secret + client.update_agent_secret (single-secret
  in-place update, the reusable primitive from the 2026-07-26 hotfix)
- tests: 15 new tests in test_firecracker_reconcile.py; updated
  test_firecracker_infra.py cold-boot cases; stale FC reprovision tests
  removed from test_backend_secret_reprovision.py

Closes #516.

tests/unit/test_macos_orchestrator.py

@@ -30,16 +30,14 @@ def _spec(src: str, tgt: str, readonly: bool = False) -> str:
 
 
 class TestMacosOrchestratorRun(unittest.TestCase):
-    def _run(self, *, local_build: bool = True) -> list[str]:
+    def _run(self) -> list[str]:
         run = Mock(return_value=_ok())
         with patch(f"{_ORCH}.container_mod") as mod, \
                 patch("bot_bottle.trust_domain.host_signing_key", return_value="k"):
             mod.dns_server.return_value = "1.1.1.1"
             mod.bind_mount_spec.side_effect = _spec
             mod.run_container_argv = run
-            MacosOrchestrator(
-                repo_root=Path("/r"), local_build=local_build,
-            )._run_container("h1")
+            MacosOrchestrator(repo_root=Path("/r"))._run_container("h1")
         return run.call_args.args[0]
 
     def test_runs_on_the_control_network_only(self) -> None:
@@ -65,11 +63,6 @@ class TestMacosOrchestratorRun(unittest.TestCase):
     def test_source_hash_is_labelled_for_recreate(self) -> None:
         self.assertIn("BOT_BOTTLE_SOURCE_HASH=h1", self._run())
 
-    def test_packaged_image_does_not_overlay_host_source(self) -> None:
-        argv = self._run(local_build=False)
-        self.assertNotIn("--mount", argv)
-        self.assertFalse(any(arg.startswith("PYTHONPATH=") for arg in argv))
-
     def test_start_failure_raises(self) -> None:
         with patch(f"{_ORCH}.container_mod") as mod, \
                 patch("bot_bottle.trust_domain.host_signing_key", return_value="k"):
@@ -152,14 +145,6 @@ class TestMacosOrchestratorBuildStop(unittest.TestCase):
         _args, kwargs = mod.build_image.call_args
         self.assertEqual("Dockerfile.orchestrator", kwargs["dockerfile"])
 
-    def test_ensure_built_pulls_packaged_image(self) -> None:
-        image = "registry/orchestrator@sha256:" + "a" * 64
-        orch = MacosOrchestrator(image, local_build=False)
-        with patch(f"{_ORCH}.container_mod") as mod:
-            orch.ensure_built()
-        mod.pull_image.assert_called_once_with(image)
-        mod.build_image.assert_not_called()
-
     def test_stop_removes_the_container(self) -> None:
         orch = MacosOrchestrator()
         with patch(f"{_ORCH}.container_mod") as mod: