refactor(gateway): move the data-plane daemons into a bot_bottle.gateway package

Separate the gateway (data plane) from the orchestrator (control plane) at the
module level. The gateway runtime files move out of the package root — and the
backend-neutral Gateway lifecycle ABC + GATEWAY_* constants move out of
orchestrator/ — into a new bot_bottle/gateway/ package:

  gateway/__init__.py      (was orchestrator/gateway.py: Gateway ABC + consts
                            + rotate_gateway_ca)
  gateway/gateway_init.py  (the PID-1 daemon supervisor)
  gateway/egress_addon.py, egress_addon_core.py, egress_dlp_config.py,
          dlp_detectors.py            (the egress mitmproxy daemon)
  gateway/git_http_backend.py         (the git-http daemon)
  gateway/git_gate_render.py          (the git-gate pre-receive rendering)
  gateway/supervise_server.py         (the supervise MCP daemon)
  gateway/policy_resolver.py          (the data-plane control-plane RPC client)

orchestrator/ now holds only control-plane files. The shared plan/types/auth
layer (egress.py=EgressPlan, git_gate.py=GitGatePlan, supervise.py,
supervise_types.py, control_auth.py) and the launch-time git-gate provisioning
helpers stay at root, so orchestrator/ and backend/ still own them.

Because these daemons are invoked as `python3 -m bot_bottle.<name>`, loaded flat
by mitmproxy, and referenced in Dockerfile.gateway, the move updates more than
Python imports: the `-m` invocations (firecracker/macOS infra scripts), the
Dockerfile.gateway addon shim + ENTRYPOINT, gateway_init's _DAEMONS module
paths, and the git-gate CGI heredocs all now point at bot_bottle.gateway.*.

No behavior change; full unit suite green (2251).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_gateway_init.py

@@ -1,6 +1,6 @@
 """Unit: gateway data-plane init supervisor (PRD 0070; PRD 0024 bundle shape).
 
-Tests both the helper functions in `bot_bottle.gateway_init`
+Tests both the helper functions in `bot_bottle.gateway.gateway_init`
 and the supervisor's end-to-end signal / exit-code behavior. The
 end-to-end tests use real subprocesses (`sleep`, `/bin/sh -c '...'`) —
 short-lived, no docker required — so they run under `tests/unit/`
@@ -18,7 +18,7 @@ import warnings
 from pathlib import Path
 from unittest.mock import patch
 
-from bot_bottle.gateway_init import (
+from bot_bottle.gateway.gateway_init import (
     _DaemonSpec,
     _Supervisor,
     _argv_for_daemon,
@@ -489,7 +489,7 @@ class TestSupervisor(unittest.TestCase):
         time.sleep(0.3)  # let `trap` register
         sup.request_shutdown(reason="test")
 
-        with patch("bot_bottle.gateway_init._GRACE_SECONDS", 0.3):
+        with patch("bot_bottle.gateway.gateway_init._GRACE_SECONDS", 0.3):
             rc = self._drive(sup, max_wait_s=4.0)
 
         # Process was SIGKILL'd → returncode -9 on POSIX.
@@ -531,7 +531,7 @@ class TestMainEndToEnd(unittest.TestCase):
 
         helper = (
             "import os, runpy, sys\n"
-            "from bot_bottle import gateway_init as si\n"
+            "from bot_bottle.gateway import gateway_init as si\n"
             "si._DAEMONS = (\n"
             f"  si._DaemonSpec('alpha', ({SLEEP!r},'30')),\n"
             f"  si._DaemonSpec('beta',  ({SLEEP!r},'30')),\n"