fix(firecracker): read only BOT_BOTTLE_INFRA_ARTIFACT_TOKEN for the artifact

Drop the fallback to the general-purpose BOT_BOTTLE_CLAUDE_GITEA_TOKEN so
the artifact pull/publish uses a dedicated, package-scoped token that can
be granted (or revoked) independently of the general Gitea token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

bot_bottle/bottle_state.py

@@ -31,7 +31,6 @@ from __future__ import annotations
 import dataclasses
 import json
 import secrets
-import socket
 import string
 from dataclasses import dataclass
 from pathlib import Path
@@ -88,14 +87,6 @@ def bottle_identity(agent_name: str) -> str:
     return f"{slug}-{suffix}"
 
 
-def globalize_slug(slug: str) -> str:
-    """Return a globally-unique slug qualified with the current hostname.
-
-    Assumes slug is a value returned from mint_slug. Use wherever a slug
-    must be unique across hosts (e.g. deploy-key titles)."""
-    return f"{socket.gethostname()}-{slug}"
-
-
 @dataclass(frozen=True)
 class BottleMetadata:
     """Persistent record of how a bottle was launched, written at
@@ -349,7 +340,6 @@ __all__ = [
     "BottleMetadata",
     "agent_state_dir",
     "bottle_identity",
-    "globalize_slug",
     "bottle_state_dir",
     "cleanup_state",
     "clear_preserve_marker",

bot_bottle/git_gate_provision.py

@@ -13,7 +13,6 @@ import dataclasses
 from pathlib import Path
 from typing import TYPE_CHECKING
 
-from .bottle_state import globalize_slug
 from .errors import MissingEnvVarError
 from .log import info
 from .manifest import ManifestBottle, ManifestGitEntry
@@ -47,7 +46,7 @@ def _provision_dynamic_key(
     owner_repo = entry.UpstreamPath
     if owner_repo.endswith(".git"):
         owner_repo = owner_repo[:-4]
-    title = f"bot-bottle:{globalize_slug(slug)}:{entry.Name}"
+    title = f"bot-bottle:{slug}:{entry.Name}"
 
     info(f"provisioning deploy key for git-gate.repos[{entry.Name!r}]")
     key_id, private_key_bytes = provisioner.create(owner_repo, title)

tests/unit/test_git_gate_render_provision.py

@@ -6,7 +6,6 @@ Covers the pure `git_gate_render_gitconfig` renderer and the dynamic
 
 from __future__ import annotations
 
-import socket
 import tempfile
 import types
 import unittest
@@ -127,9 +126,8 @@ class TestProvisionDynamicKey(unittest.TestCase):
             self.assertEqual(b"PRIVATE-KEY-BYTES", key_file.read_bytes())
             id_file = Path(d) / "repo-deploy-key-id"
             self.assertEqual("kid123", id_file.read_text())
-        # owner_repo had .git stripped; title carries globalize_slug(slug) + name
+        # owner_repo had .git stripped; title carries slug + name
-        hostname = socket.gethostname()
+        self.assertEqual([("o/r", "bot-bottle:myslug:repo")], fake.created)
-        self.assertEqual([("o/r", f"bot-bottle:{hostname}-myslug:repo")], fake.created)
 
     def test_missing_token_raises(self) -> None:
         with tempfile.TemporaryDirectory() as d, \