refactor(orchestrator): fail closed unconditionally, drop topology opt-out

Remove the empty-key opt-out codex flagged: ControlPlaneProvisioning
no longer lets the orchestrator start without a signing key when a
backend declares an "isolated" topology. Host separation is not the
safety condition — the gateway (and any other caller) must reach the
control-plane listener for /resolve, so an open orchestrator would
still grant them full `cli`. The signing key is now mandatory for
every backend.

Drops the now-purposeless Topology/COLOCATED machinery (no backend
declared a non-default topology) and the contractual
test_orchestrator_key_allows_empty_when_isolated. Updates the PRD's
invariant 4 and lifecycle docstring accordingly. Docs/behaviour only
otherwise.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_trust_domain.py

@@ -11,7 +11,6 @@ from bot_bottle.trust_domain import (
     CONTROL_PLANE,
     ControlPlaneProvisioning,
     ProvisioningError,
-    Topology,
     TrustDomain,
 )
 
@@ -78,23 +77,16 @@ class TestControlPlaneProvisioning(unittest.TestCase):
         with patch("bot_bottle.trust_domain.host_signing_key", return_value="key"):
             self.assertEqual("key", prov.orchestrator_key())
 
-    def test_orchestrator_key_fail_closes_when_colocated_and_empty(self) -> None:
-        # Invariant 4: a co-located backend must never start the control plane
-        # without a key (it would run OPEN and hand the co-located data plane
-        # full `cli`).
-        prov = ControlPlaneProvisioning()  # default topology: co-located
+    def test_orchestrator_key_fail_closes_when_empty(self) -> None:
+        # Invariant 4: the orchestrator must never start without a key — it would
+        # run OPEN and grant every caller that reaches it full `cli`. There is no
+        # topology opt-out: a separate host does not stop the gateway (or any
+        # other caller) from reaching the control-plane listener.
+        prov = ControlPlaneProvisioning()
         with patch("bot_bottle.trust_domain.host_signing_key", return_value=""):
             with self.assertRaises(ProvisioningError):
                 prov.orchestrator_key()
 
-    def test_orchestrator_key_allows_empty_when_isolated(self) -> None:
-        # A genuinely isolated control plane (no co-located data plane) may run
-        # without a key — the only topology where open mode is permissible.
-        prov = ControlPlaneProvisioning(
-            topology=Topology(data_plane_shares_control_host=False))
-        with patch("bot_bottle.trust_domain.host_signing_key", return_value=""):
-            self.assertEqual("", prov.orchestrator_key())
-
     def test_gateway_token_is_a_verifiable_gateway_role_token(self) -> None:
         prov = ControlPlaneProvisioning()
         with patch("bot_bottle.trust_domain.host_signing_key", return_value="k"):