feat(firecracker): git-gate over SSH into the gateway VM (Stage B, 7/n)

git-gate now works end-to-end for git-upstream bottles on the infra VM.
Three fixes surfaced by driving a real clone through git-http:

- `SshGatewayTransport.cp_into` preserves the source file mode (docker cp
  does). The access-hook is staged 0700 and git-http execs it directly; a
  plain `cat >` landed it 0644 -> EACCES. Keys stay 0600.
- the infra init runs `BOT_BOTTLE_GATEWAY_DAEMONS=egress,git-http,supervise`:
  the VM backend reaches git over git-http (9420), so the git:// daemon
  (git-gate, whose /git-gate-entrypoint.sh the consolidated model doesn't
  stage) is left out instead of crash-looping.
- `build_infra_rootfs_dir` folds the init's content-hash into the rootfs
  cache key, so an init change actually rebuilds the rootfs (the base image
  digest alone wouldn't catch it).

Verified on a KVM host: launch_consolidated provisions a git-upstream
bottle's repo + creds into the gateway VM over SSH; an agent VM clones via
git-http (source-IP attributed) and the access-hook resolves the
provisioned key + known_hosts and attempts the upstream SSH fetch —
failing closed only because the test used a dummy key + fake upstream
("refusing to serve stale data"). With real creds the fetch serves.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/backend/firecracker/infra_vm.py

@@ -17,9 +17,11 @@ surface.
 
 from __future__ import annotations
 
+import hashlib
 import os
 import shlex
 import signal
+import stat
 import subprocess
 import time
 import urllib.error
@@ -115,9 +117,13 @@ def ensure_built() -> None:
 
 def build_infra_rootfs_dir() -> Path:
     """The infra VM's base rootfs: the infra image prepared with the
-    control-plane + gateway init as PID 1."""
+    control-plane + gateway init as PID 1. The init's content is folded into
+    the cache key so an init change rebuilds the rootfs (the base image digest
+    alone wouldn't catch it)."""
+    init = _infra_init()
+    tag = hashlib.sha256(init.encode()).hexdigest()[:8]
     return util.build_base_rootfs_dir(
-        _INFRA_IMAGE, variant="-infra", init_script=_infra_init(),
+        _INFRA_IMAGE, variant=f"-infra-{tag}", init_script=init,
     )
 
 
@@ -278,8 +284,14 @@ class SshGatewayTransport:
                 f"infra gateway exec {argv!r} failed: {proc.stderr.strip()}")
 
     def cp_into(self, src: str, dest: str) -> None:
+        # Preserve the source mode (docker cp does): the access-hook is staged
+        # 0700 and git-http execs it directly — a plain `cat >` would land it
+        # 0644 and the exec fails with EACCES; keys stay 0600.
+        mode = stat.S_IMODE(os.stat(src).st_mode)
+        q = shlex.quote(dest)
         proc = subprocess.run(
-            util.ssh_base_argv(self._key, self._ip) + [f"cat > {shlex.quote(dest)}"],
+            util.ssh_base_argv(self._key, self._ip)
+            + [f"cat > {q} && chmod {mode:o} {q}"],
             input=Path(src).read_bytes(), capture_output=True, timeout=30, check=False,
         )
         if proc.returncode != 0:
@@ -363,8 +375,11 @@ cd /app
 BOT_BOTTLE_ROOT=/var/lib/bot-bottle python3 -m bot_bottle.orchestrator \\
     --host 0.0.0.0 --port {CONTROL_PLANE_PORT} --broker stub &
 
-# Gateway data plane (egress / git-gate / supervise), multi-tenant: each
-# request resolves source-IP -> policy against the local control plane.
+# Gateway data plane, multi-tenant: each request resolves source-IP ->
+# policy against the local control plane. The VM backend reaches git over
+# git-http (9420), so the git:// daemon (git-gate, needs a per-bottle
+# entrypoint the consolidated model doesn't use) is left out.
+BOT_BOTTLE_GATEWAY_DAEMONS=egress,git-http,supervise \\
 BOT_BOTTLE_ORCHESTRATOR_URL=http://127.0.0.1:{CONTROL_PLANE_PORT} \\
     python3 /app/gateway_init.py &