fix(firecracker): read only BOT_BOTTLE_INFRA_ARTIFACT_TOKEN for the artifact

Drop the fallback to the general-purpose BOT_BOTTLE_CLAUDE_GITEA_TOKEN so
the artifact pull/publish uses a dedicated, package-scoped token that can
be granted (or revoked) independently of the general Gitea token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

bot_bottle/bottle_state.py

@@ -31,6 +31,7 @@ from __future__ import annotations
 import dataclasses
 import json
 import secrets
+import socket
 import string
 from dataclasses import dataclass
 from pathlib import Path
@@ -87,6 +88,14 @@ def bottle_identity(agent_name: str) -> str:
     return f"{slug}-{suffix}"
 
 
+def globalize_slug(slug: str) -> str:
+    """Return a globally-unique slug qualified with the current hostname.
+
+    Assumes slug is a value returned from mint_slug. Use wherever a slug
+    must be unique across hosts (e.g. deploy-key titles)."""
+    return f"{socket.gethostname()}-{slug}"
+
+
 @dataclass(frozen=True)
 class BottleMetadata:
     """Persistent record of how a bottle was launched, written at
@@ -340,6 +349,7 @@ __all__ = [
     "BottleMetadata",
     "agent_state_dir",
     "bottle_identity",
+    "globalize_slug",
     "bottle_state_dir",
     "cleanup_state",
     "clear_preserve_marker",

bot_bottle/git_gate_provision.py

@@ -13,6 +13,7 @@ import dataclasses
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from .bottle_state import globalize_slug
 from .errors import MissingEnvVarError
 from .log import info
 from .manifest import ManifestBottle, ManifestGitEntry
@@ -46,7 +47,7 @@ def _provision_dynamic_key(
     owner_repo = entry.UpstreamPath
     if owner_repo.endswith(".git"):
         owner_repo = owner_repo[:-4]
-    title = f"bot-bottle:{slug}:{entry.Name}"
+    title = f"bot-bottle:{globalize_slug(slug)}:{entry.Name}"
 
     info(f"provisioning deploy key for git-gate.repos[{entry.Name!r}]")
     key_id, private_key_bytes = provisioner.create(owner_repo, title)

tests/unit/test_git_gate_render_provision.py

@@ -6,6 +6,7 @@ Covers the pure `git_gate_render_gitconfig` renderer and the dynamic
 
 from __future__ import annotations
 
+import socket
 import tempfile
 import types
 import unittest
@@ -126,8 +127,9 @@ class TestProvisionDynamicKey(unittest.TestCase):
             self.assertEqual(b"PRIVATE-KEY-BYTES", key_file.read_bytes())
             id_file = Path(d) / "repo-deploy-key-id"
             self.assertEqual("kid123", id_file.read_text())
-        # owner_repo had .git stripped; title carries slug + name
-        self.assertEqual([("o/r", "bot-bottle:myslug:repo")], fake.created)
+        # owner_repo had .git stripped; title carries globalize_slug(slug) + name
+        hostname = socket.gethostname()
+        self.assertEqual([("o/r", f"bot-bottle:{hostname}-myslug:repo")], fake.created)
 
     def test_missing_token_raises(self) -> None:
         with tempfile.TemporaryDirectory() as d, \