refactor(manifest): rename egress_proxy key to egress

Now that `bottle.egress` (the old allowlist/dlp_action block) is
gone, the longer `egress_proxy:` disambiguator isn't needed. The
manifest field reads more naturally as just `egress:` with the
same nested `routes: [...]` shape.

Renamed:
  - Manifest YAML key:    `egress_proxy:` → `egress:`
  - Bottle dataclass attr: `bottle.egress_proxy` → `bottle.egress`
  - `_BOTTLE_KEYS` entry, schema docstring, and all
    user-facing error message labels (`egress.routes[N]`,
    `egress has unknown key …`, etc.).

Kept (these refer to the egress-proxy SIDECAR, not the manifest
field):
  - File names: `egress_proxy.py`, `egress_proxy_apply.py`,
    `egress_proxy_addon.py`, `egress_proxy_addon_core.py`.
  - Class names: `EgressProxyConfig`, `EgressProxyRoute`,
    `EgressProxyPlan`, `EgressProxy`, `DockerEgressProxy`.
  - Helper names: `egress_proxy_manifest_routes`,
    `egress_proxy_routes_for_bottle`,
    `egress_proxy_token_env_map`, etc.
  - Constants: `EGRESS_PROXY_HOSTNAME`, `EGRESS_PROXY_ROLES`,
    `EGRESS_PROXY_AUTH_SCHEMES`, `EGRESS_PROXY_FORWARD_PROXY`,
    `EGRESS_PROXY_INTROSPECT_URL`, `EGRESS_PROXY_PORT`, etc.
  - Container name prefix `claude-bottle-egress-proxy-*`, the
    `egress-proxy` docker network alias, the
    `egress-proxy-block` + `list-egress-proxy-routes` MCP tool
    IDs, the `egress-proxy` audit-log component label.

Local bottle migrated (`~/.claude-bottle/bottles/dev.md` already
updated). The legacy `egress_proxy` key isn't surfaced anywhere
anymore; the generic unknown-key validator catches typos with a
"did you mean: egress, env, git, supervise" hint.

409 unit + integration tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_proxy.py

@@ -147,7 +147,7 @@ DEFAULT_ALLOWLIST: tuple[str, ...] = (
 def egress_proxy_manifest_routes(
     bottle: Bottle,
 ) -> tuple[EgressProxyRoute, ...]:
-    """Lift each `bottle.egress_proxy.routes[]` manifest entry into a
+    """Lift each `bottle.egress.routes[]` manifest entry into a
     resolved EgressProxyRoute. Order is preserved so route lookup at
     the proxy is stable.
 
@@ -163,7 +163,7 @@ def egress_proxy_manifest_routes(
     addon enforces."""
     out: list[EgressProxyRoute] = []
     slot_for_token: dict[str, str] = {}
-    for r in bottle.egress_proxy.routes:
+    for r in bottle.egress.routes:
         if r.AuthScheme and r.TokenRef:
             token_env = slot_for_token.get(r.TokenRef)
             if token_env is None:
@@ -199,7 +199,7 @@ def egress_proxy_routes_for_bottle(
 
     Operators that want to allow an arbitrary host that isn't in
     DEFAULT_ALLOWLIST declare it directly in
-    `bottle.egress_proxy.routes` as a bare-pass entry
+    `bottle.egress.routes` as a bare-pass entry
     (`- host: <name>`). The legacy `bottle.egress.allowlist`
     folding is gone — egress_proxy is the single allowlist surface."""
     out: list[EgressProxyRoute] = list(egress_proxy_manifest_routes(bottle))
@@ -279,7 +279,7 @@ def egress_proxy_resolve_token_values(
             die(
                 f"egress-proxy: host env var '{token_ref}' is unset. Set it "
                 f"before launching, or remove the corresponding auth block "
-                f"from bottle.egress_proxy.routes."
+                f"from bottle.egress.routes."
             )
         if not value:
             die(
@@ -298,7 +298,7 @@ class EgressProxy(ABC):
     concrete subclasses."""
 
     def prepare(self, bottle: Bottle, slug: str, stage_dir: Path) -> EgressProxyPlan:
-        """Lift `bottle.egress_proxy.routes` into resolved routes,
+        """Lift `bottle.egress.routes` into resolved routes,
         render the routes file (mode 600) under `stage_dir`, and
         return the plan. Pure host-side, no docker subprocess. The
         token-env map records the mapping the launch step uses to