Expand gateway portal peer lifecycle and reinforce healthchecks

[aidankhogg]

Motivation

• Implement explicit cross-world peer lifecycle operations (add/update/remove/rotate/reapply) so peer artifacts are managed deterministically and can be reconciled after gateway restarts.
• Improve runtime visibility so healthchecks validate concrete gateway artifacts (nftables tables, trust anchors, DNS stubs, endpoint reachability) instead of a simple presence flag.
• Provide rollback when a multi-step peer setup partially succeeds to avoid stale state and leftover rules.
• Surface implemented support in the docs so the alpha feature-state matches the runtime behavior.

Description

• Added gateway helper APIs in GatewayHandler: gateway_reachable, nft_table_exists, path_exists, peer_endpoint_reachable, and reapply_peer_routing for reachability checks and reloading persisted peer rule files.
• Reworked GatewayPortalHandler to replace the single-output healthcheck with a multi-check health routine that validates gateway exec reachability, the internet nftables table (when applicable), per-peer nftables tables, trust-anchor file presence, CoreDNS stub presence, and best-effort peer endpoint probes; health metadata is recorded into gateway_portal_output["healthchecks"].
• Implemented explicit peer lifecycle operations in GatewayPortalHandler: add_peer, update_peer, remove_peer, rotate_trust_anchor, and reapply_routing_after_gateway_restart, and updated _apply_cross_world to use add_peer.
• Rewrote _setup_peer to build a persistent artifact describing installed peer artifacts (nft table name, routing rules path, dns zone/forwarder, trust anchor path, timestamps), persist peer_artifacts into context.runtime_state.gateway_portal_output, and perform rollback via _rollback_peer_setup when later steps fail after earlier ones succeeded.
• Added Corefile manipulation helpers (_remove_peer_dns, _corefile_contains_stub) and artifact helpers (_safe_peer_name, _trust_anchor_path, _upsert_peer_artifact, _drop_peer_artifact).
• Updated upstream resolver and cross-world feature-state docs in docs/support-matrix.md and docs/spec-alpha-support.md to mark implemented pieces as experimental and describe caveats.
• Added/expanded tests in tests/test_gateway_portal.py to cover lifecycle operations, rollback behavior, artifact tracking, healthcheck verification, and routing reapply; existing cross-world unit tests were adjusted to align with the new behaviors.

Testing

• Ran ruff formatting and ruff check on modified files and fixed linter issues, with checks passing.
• Executed unit and integration tests: pytest -q tests/test_gateway_portal.py tests/test_gateway_federation.py, with all tests passing (50 passed, 8 warnings).
• Performed focused tests for gateway portal lifecycle: peer add/update/remove, trust-anchor rotation, rollback on DNS failure, healthcheck assertions, and routing reapply after gateway restart, and observed expected pass/fail behaviors in the test suite.

---

Codex Task