refactor(pipelock): PipelockProxy.prepare takes a Bottle, not (manifest, name)

Matches the allowlist-resolution helpers' shape: the caller resolves
the bottle once and passes it in. Signature drops from
(manifest, bottle_name, slug, yaml_path) to (bottle, slug, yaml_path).

DockerBottleBackend.prepare_proxy uses manifest.bottle_for(agent_name)
to get the bottle directly. Tests pass fixture.bottles[name].

prepare's docstring also explains what `slug` is: the lowercased,
hyphen-normalized agent identifier used as the suffix in every
per-agent resource name (agent container, pipelock container, the
internal/egress networks). It's stored on the plan so start can
derive the sidecar's container name.

Top-level pipelock.py drops the Manifest import — no longer used.

claude_bottle/backend/docker/backend.py

@@ -136,9 +136,9 @@ class DockerBottleBackend(BottleBackend):
         PipelockProxyPlan for the launch step to consume. Stage-only:
         no Docker resources created yet."""
         yaml_path = stage_dir / "pipelock.yaml"
-        bottle_name = spec.manifest.agents[spec.agent_name].bottle
+        bottle = spec.manifest.bottle_for(spec.agent_name)
         slug = docker_mod.slugify(spec.agent_name)
-        return self._proxy.prepare(spec.manifest, bottle_name, slug, yaml_path)
+        return self._proxy.prepare(bottle, slug, yaml_path)
 
     @contextmanager
     def launch(self, plan: BottlePlan) -> Iterator[DockerBottle]: