Server gate functions only recognized 'pypi', while the agent reports
'pip'. This made NeedsCapabilityGate('pip') return false, silently
routing pip installs through the legacy un-gated path.
All four gate functions now accept 'pip' with 'pypi' retained as an
alias for existing DB records.