fix(macos_container): mount supervise db's parent dir, not the file

Apple's `container run --mount type=bind` only accepts directory
sources — a file source fails with "path '<file>' is not a
directory". Move the sqlite db into its own ~/.bot-bottle/db/
subdirectory so it can be bind-mounted the same way the CA/routes
mounts already are, without exposing the rest of ~/.bot-bottle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bot_bottle/supervise.py

@@ -110,7 +110,10 @@ def host_db_path() -> Path:
     # Calls bot_bottle_root() through this module's globals so that patches
     # on supervise.bot_bottle_root propagate to callers going through
     # supervise.host_db_path().
-    return bot_bottle_root() / HOST_DB_FILENAME
+    #
+    # Kept in its own "db" subdirectory (see supervise_types.host_db_path
+    # for why) — must stay in sync with that copy.
+    return bot_bottle_root() / "db" / HOST_DB_FILENAME
 
 
 def audit_log_path(component: str, slug: str) -> Path: