feat(git-gate): source-IP-keyed multi-tenant repo namespace (PRD 0070)

First slice of git-gate consolidation: make the smart-HTTP git backend
serve every bottle from one process, selecting each request's repo root by
the calling bottle's source IP — the same attribution invariant + resolver
the multi-tenant egress addon uses. `git daemon` can't source-IP-route per
connection, so the consolidated gateway serves git-gate over this HTTP
backend (the transport firecracker/macOS already use); wiring the docker
path onto it lands with the launch-integration slice.

- policy_resolver: factor out `_post_resolve`; add `resolve_bottle_id`
  (source IP -> bottle id, same fail-closed 403->None contract as
  `resolve`) — the git-gate has no policy blob to parse, the bottle *is*
  the namespace.
- git_http_backend: `resolve_repo_root(resolver, base, source_ip, token)`
  — single-tenant passthrough when no resolver; else `<base>/<bottle_id>`,
  fail-closed on unattributed / resolver error / namespace escape.
  `BOT_BOTTLE_ORCHESTRATOR_URL` (same env as egress) flips the shared
  gateway multi-tenant; the identity header is read for attribution and
  never forwarded to the CGI. Per-repo creds + hooks scope by repo dir, so
  isolating the root per bottle isolates its creds too.

Single-tenant path unchanged (existing real-git-push tests green). New unit
coverage for the resolver + repo-root selection matrix. Full unit suite
green (1690 tests; the 13 test_sidecar_init /bin/sleep errors are the
pre-existing NixOS-local noise).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

tests/unit/test_policy_resolver.py

@@ -71,6 +71,23 @@ class TestPolicyResolver(unittest.TestCase):
             self.r.resolve("10.243.0.7")  # token optional
         self.assertEqual("", json.loads(m.call_args.args[0].data)["identity_token"])
 
+    def test_resolve_bottle_id_returns_id(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"bottle_id": "b1", "policy": "P"})):
+            self.assertEqual("b1", self.r.resolve_bottle_id("10.243.0.1", "tok"))
+
+    def test_resolve_bottle_id_403_is_none_fail_closed(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(403)):
+            self.assertIsNone(self.r.resolve_bottle_id("10.243.0.9", "tok"))
+
+    def test_resolve_bottle_id_missing_field_is_none(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"policy": "P"})):
+            self.assertIsNone(self.r.resolve_bottle_id("10.243.0.1", "tok"))
+
+    def test_resolve_bottle_id_error_raises(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(500)):
+            with self.assertRaises(PolicyResolveError):
+                self.r.resolve_bottle_id("10.243.0.1", "tok")
+
 
 if __name__ == "__main__":
     unittest.main()