fix(macos): review fixes — token on plan, self-heal, symmetric digest, DHCP poll

Addresses findings from a high-effort review of the PRD 0070 macOS backend.

Correctness:
- Stamp identity_token onto MacosContainerBottlePlan after registration. git's
  gitconfig extraHeader and the supervise MCP --header read
  getattr(plan,"identity_token","") at provision time, and both reach the
  gateway on NO_PROXY (bypassing the egress proxy that carries the token). The
  plan never carried it, so /resolve fail-closed and every git fetch/push and
  supervise call from a macOS bottle would have been denied. Registration
  precedes provision(), so — unlike the run-time env — the plan can carry it.
- Self-heal the orchestrator: recreate when it is not (source-current AND
  answering /health), not on the source-hash label alone. A container running
  current code but with a wedged HTTP server was left alone and polled to
  death, failing every launch until manual deletion.
- image_digest and container_image_digest now read the same descriptor.digest
  field; dropped image_digest's id/tag fallback that could yield a value the
  container side can't produce — a permanent mismatch would have recreated the
  shared gateway on every launch (severing every live bottle's egress, since
  the replacement gets a new DHCP address).
- Poll for the agent's and gateway's DHCP address instead of a fatal read
  right after `container run` (there is no --ip; the address can lag start).

Cleanup:
- One _inspect_first + _descriptor_digest behind the four inspect readers.
- Shared bind_mount_spec (util) and host_db_dir (paths) replace per-module
  copies; _GIT_HTTP_PORT now imports git_http_backend.DEFAULT_PORT.
- Drop the dead _url cache / url property and the write-only agent_proxy_url.

Deferred (noted on the PR, not fixed here): the gateway image rebuilding on
every launch (needs source-hash-labeled build), SQLite shared across VM
guests, and the sh -lc profile-override edge — each is design-level or
behavior-risk beyond a review fix.

Verified: real Apple Container bring-up is green and idempotent; 1826 unit
tests pass with `container` absent (CI parity), pyright clean, pylint 9.86.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bot_bottle/backend/macos_container/gateway.py

@@ -36,9 +36,10 @@ from ...orchestrator.gateway import (
     Gateway,
     GatewayError,
 )
-from ...paths import host_db_path
+from ...paths import host_db_dir
 from ...supervise import DB_PATH_IN_CONTAINER
 from . import util as container_mod
+from .util import bind_mount_spec as _mount
 
 # Distinct from the docker gateway's names so both backends' gateways can
 # coexist on one host (a macOS host can run the docker backend too).
@@ -69,7 +70,7 @@ def gateway_ca_dir() -> Path:
     The docker gateway uses a named volume for this; a plain host dir is the
     same guarantee with fewer moving parts, and it lets `ca_cert_pem` read the
     PEM straight off the host instead of shelling into the container."""
-    path = host_db_path().parent / "mac-gateway-ca"
+    path = host_db_dir() / "mac-gateway-ca"
     path.mkdir(parents=True, exist_ok=True)
     return path
 
@@ -88,19 +89,6 @@ def ensure_networks(
     container_mod.create_network(network, internal=True)
 
 
-def _host_db_dir() -> str:
-    db_dir = host_db_path().parent
-    db_dir.mkdir(parents=True, exist_ok=True)
-    return str(db_dir)
-
-
-def _mount(source: str, target: str, *, readonly: bool = False) -> str:
-    spec = f"type=bind,source={source},target={target}"
-    if readonly:
-        spec += ",readonly"
-    return spec
-
-
 class AppleGateway(Gateway):
     """The consolidated gateway as a single, fixed-name Apple container."""
 
@@ -187,7 +175,7 @@ class AppleGateway(Gateway):
             # The NAT gateway routes but does not resolve, so DNS is explicit.
             "--dns", container_mod.dns_server(),
             "--mount", _mount(str(gateway_ca_dir()), MITMPROXY_HOME),
-            "--mount", _mount(_host_db_dir(), _SUPERVISE_DB_DIR_IN_CONTAINER),
+            "--mount", _mount(str(host_db_dir()), _SUPERVISE_DB_DIR_IN_CONTAINER),
             "--env", f"SUPERVISE_DB_PATH={DB_PATH_IN_CONTAINER}",
         ]
         if self._orchestrator_url:
@@ -204,8 +192,14 @@ class AppleGateway(Gateway):
 
     def ip_on_shared_network(self) -> str:
         """The gateway's address on the shared host-only network — what agents
-        point their proxy / git-http / supervise URLs at."""
-        return container_mod.container_ipv4_on_network(self.name, self.network)
+        point their proxy / git-http / supervise URLs at. Polls: a freshly
+        run gateway can be up before vmnet's DHCP has assigned the address."""
+        ip = container_mod.wait_container_ipv4_on_network(self.name, self.network)
+        if not ip:
+            raise GatewayError(
+                f"gateway {self.name} never got an address on {self.network}"
+            )
+        return ip
 
     def ca_cert_pem(self, *, timeout: float = DEFAULT_CA_TIMEOUT_SECONDS) -> str:
         """The gateway's CA certificate (PEM) that agents install to trust its