refactor(boundary): move orchestrator/ -> agent/, controllers/ -> supervisor/controllers/

PR-3 of the agent/supervisor boundary work (behavior-neutral physical move).

- src/aleph/vm/orchestrator/ -> src/aleph/vm/agent/ (the Aleph network agent).
- src/aleph/vm/controllers/ -> src/aleph/vm/supervisor/controllers/ (the
  supervisor's execution worker; entry point becomes
  python -m aleph.vm.supervisor.controllers).
- Update all imports, the console script (aleph.vm.agent.cli:main), and the
  systemd ExecStart targets. Service names and the %i-controller.json config path
  are unchanged.
- Rework the import-linter contracts for the new layout: contract independent;
  controllers (now under supervisor) don't import the agent; the agent doesn't
  reach the supervisor daemon modules (composition root excepted); the supervisor
  doesn't import the agent (DB/aggregate-settings residuals documented).

Stacked on PR-1 (#986). configuration.py already moved to contract/ in PR-1.
Behavior-neutral: supervisor+migration suite 922 passed (only the pre-existing
root-only test_interfaces failures remain), mypy baseline unchanged, lint-imports
4 kept / 0 broken.

Author: odesenfans

packaging/aleph-vm/etc/systemd/system/aleph-vm-agent.service

@@ -10,7 +10,7 @@ WorkingDirectory=/opt/aleph-vm
 Environment=PYTHONPATH=/opt/aleph-vm/:$PYTHONPATH
 Environment=PYTHONDONTWRITEBYTECODE="enabled"
 EnvironmentFile=/etc/aleph-vm/supervisor.env
-ExecStart=python3 -m aleph.vm.orchestrator --print-settings
+ExecStart=python3 -m aleph.vm.agent --print-settings
 Restart=on-failure
 RestartPreventExitStatus=0 130 143
 RestartSec=10s

packaging/aleph-vm/etc/systemd/system/aleph-vm-controller@.service

@@ -10,7 +10,7 @@ PrivateTmp=yes
 NoNewPrivileges=true
 WorkingDirectory=/opt/aleph-vm
 Environment=PYTHONPATH=/opt/aleph-vm/:$PYTHONPATH
-ExecStart=/usr/bin/python3 -m aleph.vm.controllers --config=/var/lib/aleph/vm/%i-controller.json
+ExecStart=/usr/bin/python3 -m aleph.vm.supervisor.controllers --config=/var/lib/aleph/vm/%i-controller.json
 Restart=on-failure
 # KillMode=Mixed is used so initially only the Python controller process receives the SIGTERM signal.
 # The controller catches it and sends an ACPI powerdown to the Guest VM, giving it time to shut down

pyproject.toml

@@ -69,7 +69,7 @@ urls.Discussions = "https://community.aleph.im/"
 urls.Documentation = "https://docs.aleph.cloud/nodes/compute/introduction/"
 urls.Issues = "https://github.com/aleph-im/aleph-vm/issues"
 urls.Source = "https://github.com/aleph-im/aleph-vm"
-scripts.aleph-vm = "aleph.vm.orchestrator.cli:main"
+scripts.aleph-vm = "aleph.vm.agent.cli:main"
 
 [tool.hatch.version]
 source = "vcs"
@@ -280,9 +280,8 @@ type = "forbidden"
 allow_indirect_imports = "true"
 source_modules = [ "aleph.vm.supervisor_interface" ]
 forbidden_modules = [
-  "aleph.vm.orchestrator",
+  "aleph.vm.agent",
   "aleph.vm.supervisor",
-  "aleph.vm.controllers",
   "aleph.vm.pool",
   "aleph.vm.models",
   "aleph.vm.network",
@@ -291,39 +290,47 @@ forbidden_modules = [
 ]
 
 [[tool.importlinter.contracts]]
-name = "controllers are a supervisor worker, not the agent or the daemon"
+name = "controllers do not import the agent"
 type = "forbidden"
 allow_indirect_imports = "true"
-source_modules = [ "aleph.vm.controllers" ]
-forbidden_modules = [ "aleph.vm.orchestrator", "aleph.vm.supervisor" ]
+source_modules = [ "aleph.vm.supervisor.controllers" ]
+forbidden_modules = [ "aleph.vm.agent" ]
 
 [[tool.importlinter.contracts]]
-name = "the agent does not reach into the supervisor implementation"
+name = "the agent does not reach into the supervisor daemon"
 type = "forbidden"
 allow_indirect_imports = "true"
-source_modules = [ "aleph.vm.orchestrator" ]
-forbidden_modules = [ "aleph.vm.supervisor" ]
-# Composition root only: the agent entrypoints pick a concrete Supervisor impl
-# at startup. All other agent code goes through aleph.vm.supervisor_interface.abc.Supervisor.
+source_modules = [ "aleph.vm.agent" ]
+forbidden_modules = [
+  "aleph.vm.supervisor.local",
+  "aleph.vm.supervisor.grpc_server",
+  "aleph.vm.supervisor.grpc_client",
+  "aleph.vm.supervisor.daemon",
+  "aleph.vm.supervisor.proto_convert",
+  "aleph.vm.supervisor._pb",
+  "aleph.vm.supervisor.error_mapping",
+  "aleph.vm.supervisor.qemu_build",
+]
+# Composition root only: the agent entrypoints pick a concrete Supervisor impl.
+# Agent->supervisor.controllers (Resources, controller exception types, cloudinit)
+# remains a documented residual removed by PR-2 (the controller split).
 ignore_imports = [
-  "aleph.vm.orchestrator.cli -> aleph.vm.supervisor.local",
-  "aleph.vm.orchestrator.supervisor -> aleph.vm.supervisor.local",
-  "aleph.vm.orchestrator.supervisor -> aleph.vm.supervisor.grpc_client",
+  "aleph.vm.agent.cli -> aleph.vm.supervisor.local",
+  "aleph.vm.agent.supervisor -> aleph.vm.supervisor.local",
+  "aleph.vm.agent.supervisor -> aleph.vm.supervisor.grpc_client",
 ]
 
 [[tool.importlinter.contracts]]
 name = "the supervisor does not import the agent"
 type = "forbidden"
 allow_indirect_imports = "true"
 source_modules = [ "aleph.vm.supervisor", "aleph.vm.pool", "aleph.vm.models" ]
-forbidden_modules = [ "aleph.vm.orchestrator" ]
-# Residuals to be removed by the VmExecution/VmPool cleave + DB-layer extraction
-# (docs/plans/2026-05-28 section 4): the shared port-mappings persistence and the
-# aggregate-settings cache still live under orchestrator today.
+forbidden_modules = [ "aleph.vm.agent" ]
+# Residuals removed by the VmExecution/VmPool cleave + DB-layer extraction.
 ignore_imports = [
-  "aleph.vm.models -> aleph.vm.orchestrator.metrics",
-  "aleph.vm.pool -> aleph.vm.orchestrator.metrics",
-  "aleph.vm.pool -> aleph.vm.orchestrator.utils",
-  "aleph.vm.supervisor.daemon -> aleph.vm.orchestrator.metrics",
-  "aleph.vm.supervisor.local -> aleph.vm.orchestrator.metrics",
+  "aleph.vm.models -> aleph.vm.agent.metrics",
+  "aleph.vm.pool -> aleph.vm.agent.metrics",
+  "aleph.vm.pool -> aleph.vm.agent.utils",
+  "aleph.vm.supervisor.daemon -> aleph.vm.agent.metrics",
+  "aleph.vm.supervisor.local -> aleph.vm.agent.metrics",
 ]