refactor: make the two remaining heavy __init__ modules lazy

Audit of package __init__ import cost turned up two eager ones:

orchestrator/__init__.py (27 -> 2): was pure `from .X import Y`
re-exports (registry_store, broker, docker_broker, gateway, service,
server). Because importing any submodule runs the parent __init__, the
CLI migration gate (orchestrator.store.store_manager, hit on every
command) transitively dragged backend.docker, docker_broker, server, and
http.server. Converted to the same lazy __getattr__ + _LAZY facade used
by manifest/backend/egress/git_gate; the re-export API is unchanged and
the docker/http drag is gone.

cli/commands/__init__.py (78 -> 23): the registry imported all twelve
handlers to build COMMANDS, so importing one command pulled all of them
plus their deps. COMMANDS now maps each name to a thin lazy wrapper that
imports its handler's module on first dispatch. Values stay callable, so
the dispatcher and the patch.dict dispatch tests are unchanged; a CLI run
now loads only the one command it dispatches. The remaining 23 is the
dispatcher's own baseline (store_manager migration gate + help + log).

Full unit suite green (2243); `bb help` + dispatch/migration-gate tests
verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/cli/commands/__init__.py

@@ -1,41 +1,52 @@
 """CLI subcommand registry.
 
 One module per `bot-bottle <command>`, each exposing a `cmd_<name>(argv)`
-handler. This package `__init__` assembles them into the COMMANDS table
-the dispatcher (`bot_bottle.cli.__main__`) reads. Shared CLI helpers
-(`constants`, `tui`) stay one level up in the `cli` package.
+handler. This package `__init__` maps command names to their handlers
+**lazily**: a short-lived CLI run dispatches exactly one command, so
+importing all twelve handlers (and their transitive deps — backend,
+manifest, orchestrator, …) up front is wasted work. Each COMMANDS value is
+a thin wrapper that imports its handler's module on first call. Shared CLI
+helpers (`constants`, `tui`) stay one level up in the `cli` package.
 """
 
 from __future__ import annotations
 
-from .backend import cmd_backend
-from .cleanup import cmd_cleanup
-from .commit import cmd_commit
-from .edit import cmd_edit
-from .help import cmd_help
-from .info import cmd_info
-from .init import cmd_init
-from .list import cmd_list
-from .login import cmd_login
-from .resume import cmd_resume
-from .start import cmd_start
-from .supervise import cmd_supervise
+from importlib import import_module
+from typing import Callable
 
-COMMANDS = {
-    "backend": cmd_backend,
-    "cleanup": cmd_cleanup,
-    "commit": cmd_commit,
-    "edit": cmd_edit,
-    "help": cmd_help,
-    "info": cmd_info,
-    "init": cmd_init,
-    "list": cmd_list,
-    "login": cmd_login,
-    "resume": cmd_resume,
-    "start": cmd_start,
-    "supervise": cmd_supervise,
+# command name -> "<submodule>:<handler attr>". Kept as strings so building
+# the registry imports nothing; the module loads only when dispatched.
+_HANDLERS: dict[str, str] = {
+    "backend": "backend:cmd_backend",
+    "cleanup": "cleanup:cmd_cleanup",
+    "commit": "commit:cmd_commit",
+    "edit": "edit:cmd_edit",
+    "help": "help:cmd_help",
+    "info": "info:cmd_info",
+    "init": "init:cmd_init",
+    "list": "list:cmd_list",
+    "login": "login:cmd_login",
+    "resume": "resume:cmd_resume",
+    "start": "start:cmd_start",
+    "supervise": "supervise:cmd_supervise",
 }
 
+
+def _lazy(spec: str) -> Callable[[list[str]], "int | None"]:
+    """Wrap a `<module>:<attr>` handler so its module is imported only when
+    the command is actually dispatched, not when the registry is built."""
+    module, attr = spec.split(":")
+
+    def run(argv: list[str]) -> "int | None":
+        handler = getattr(import_module(f".{module}", __name__), attr)
+        return handler(argv)
+
+    run.__name__ = attr
+    return run
+
+
+COMMANDS = {name: _lazy(spec) for name, spec in _HANDLERS.items()}
+
 # Commands that manage host prerequisites (or are otherwise store-free) and
 # must run before — or without — a migrated DB. `backend` provisions/probes
 # the host (TAP pool, /dev/kvm, firecracker) and never opens the store, so

bot_bottle/orchestrator/__init__.py

@@ -5,7 +5,7 @@ A single persistent per-host service that will run the gateway functions
 agent launches. This package is being built bottom-up, starting with the
 backend-neutral "consolidation core" that needs no VM packaging:
 
-  * `registry`      — the SQLite runtime-state store + fail-closed
+  * `store.registry_store` — the SQLite runtime-state store + fail-closed
                       attribution (source IP + per-bottle identity token).
   * `broker`        — the signed, structured launch-request contract + a
                       `LaunchBroker` (stub for the harness) that verifies
@@ -28,36 +28,58 @@ orchestrator -> firecracker).
 
 from __future__ import annotations
 
-from .store.registry_store import BottleRecord, RegistryStore, new_identity_token
-from .broker import (
-    BrokerAuthError,
-    LaunchBroker,
-    LaunchRequest,
-    StubBroker,
-    sign_request,
-    verify_request,
-)
-from .docker_broker import DockerBroker, DockerBrokerError
-from ..gateway import Gateway, GatewayError
-from .service import Orchestrator
-from .server import OrchestratorServer, dispatch, make_server
+from typing import TYPE_CHECKING, Any
 
-__all__ = [
-    "BottleRecord",
-    "RegistryStore",
-    "new_identity_token",
-    "BrokerAuthError",
-    "LaunchBroker",
-    "LaunchRequest",
-    "StubBroker",
-    "DockerBroker",
-    "DockerBrokerError",
-    "Gateway",
-    "GatewayError",
-    "sign_request",
-    "verify_request",
-    "Orchestrator",
-    "OrchestratorServer",
-    "dispatch",
-    "make_server",
-]
+if TYPE_CHECKING:
+    from .store.registry_store import BottleRecord, RegistryStore, new_identity_token
+    from .broker import (
+        BrokerAuthError,
+        LaunchBroker,
+        LaunchRequest,
+        StubBroker,
+        sign_request,
+        verify_request,
+    )
+    from .docker_broker import DockerBroker, DockerBrokerError
+    from ..gateway import Gateway, GatewayError
+    from .service import Orchestrator
+    from .server import OrchestratorServer, dispatch, make_server
+
+
+# Facade name -> submodule that defines it. Lazy so importing a leaf (or the
+# parent package, e.g. via `orchestrator.store.store_manager`) doesn't drag the
+# whole orchestrator — server, docker_broker + the docker backend, http — while
+# `from bot_bottle.orchestrator import RegistryStore` keeps working.
+_LAZY: dict[str, str] = {
+    "BottleRecord": ".store.registry_store",
+    "RegistryStore": ".store.registry_store",
+    "new_identity_token": ".store.registry_store",
+    "BrokerAuthError": ".broker",
+    "LaunchBroker": ".broker",
+    "LaunchRequest": ".broker",
+    "StubBroker": ".broker",
+    "sign_request": ".broker",
+    "verify_request": ".broker",
+    "DockerBroker": ".docker_broker",
+    "DockerBrokerError": ".docker_broker",
+    "Gateway": "..gateway",
+    "GatewayError": "..gateway",
+    "Orchestrator": ".service",
+    "OrchestratorServer": ".server",
+    "dispatch": ".server",
+    "make_server": ".server",
+}
+
+
+def __getattr__(name: str) -> Any:
+    src = _LAZY.get(name)
+    if src is None:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    from importlib import import_module
+
+    value = getattr(import_module(src, __name__), name)
+    globals()[name] = value
+    return value
+
+
+__all__ = list(_LAZY)