feat(orchestrator): slice 4 — consolidated per-host sidecar (#352)

The core consolidation win: one persistent sidecar per host, shared by
every bottle, instead of a sidecar bundle per bottle. Safe to share
because the attribution invariant (source IP + identity token) lets the
sidecar map each request to the right bottle.

  * orchestrator/sidecar.py — a backend-neutral `Sidecar` lifecycle
    contract (mirrors LaunchBroker) + a `DockerSidecar` impl. The defining
    behaviour is idempotent singleton: `ensure_running` starts the instance
    if absent and is a no-op if it's already up, so N launches never spawn
    N sidecars; `stop` is idempotent.
  * orchestrator/dockerutil.py — a shared `run_docker` helper; DockerBroker
    now uses it too (DRY with slice 3).
  * service.py — the Orchestrator holds an optional `Sidecar`, exposes
    `ensure_sidecar()` + `sidecar_status()`.
  * control_plane.py — `GET /sidecar` reports it; __main__ gains
    `--sidecar-image` and ensures the single sidecar on startup.

Tests: unit (docker mocked) — is_running, ensure idempotent (no-op when up,
starts when absent), failure raises, stop idempotent; Orchestrator sidecar
wiring/status; control-plane /sidecar; integration (gated) — ensure is a
real idempotent singleton (one container after two ensures), stop removes.
Full suite green (only pre-existing /bin/sleep errors); integration
verified locally against real docker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

bot_bottle/orchestrator/control_plane.py

@@ -5,6 +5,7 @@ The backend-agnostic control-plane RPC (CLI / console -> orchestrator) over
 vsock / unix-socket portability caveats):
 
     GET    /health              -> 200 {"status": "ok"}
+    GET    /sidecar             -> 200 {"configured", ["name", "running"]}
     GET    /bottles             -> 200 {"bottles": [ <redacted record>, ... ]}
     POST   /bottles             -> 201 {"bottle_id", "identity_token"}    (launch)
                                    body: {"source_ip", ["image_ref"], ["metadata"]}
@@ -58,6 +59,9 @@ def dispatch(  # pylint: disable=too-many-return-statements
     if method == "GET" and route == "/health":
         return 200, {"status": "ok"}
 
+    if method == "GET" and route == "/sidecar":
+        return 200, orch.sidecar_status()
+
     if method == "GET" and route == "/bottles":
         return 200, {"bottles": [r.redacted() for r in orch.registry.all()]}