feat(egress-proxy-block): single-route input + merge-on-apply

Instead of asking the agent to compose and submit a full routes
file, the tool now takes ONE proposed route — host + optional
path_allowlist + optional auth — and the supervisor merges it
into the live routes table at approval time. The agent no longer
needs to fetch / reproduce / extend the existing allowlist; it
just describes the host it wants reachable.

Tool input (new):
  - `host` (required)
  - `path_allowlist` (optional, array of absolute path prefixes)
  - `auth` (optional, {scheme, token_ref})
  - `justification` (required)

Merge semantics (in `egress_proxy_apply._merge_single_route`):
  - Host NOT in current routes → append the proposed route as a
    new entry. If `auth` is set, assign the next EGRESS_PROXY_TOKEN_N
    slot.
  - Host already present → union the proposed `path_allowlist`
    with the existing one (proposed entries appended after
    existing, deduped). Existing `auth_scheme` / `token_env`
    preserved; proposed `auth` ignored (operator-controlled, not
    agent-controlled).
  - Hostname comparison is case-insensitive.

Dashboard wiring: `approve()` on an egress-proxy-block proposal
now calls `add_route(slug, proposed_route_json)` instead of
`apply_routes_change(slug, full_file)`. add_route fetches the
current routes from the running egress-proxy, merges, and calls
apply_routes_change with the merged content — so the
pipelock-mirror + SIGHUP plumbing from chunk 3 still runs
end-to-end. Audit diff still captures the full-file before/after.

Tool description rewritten to make the new shape obvious and to
stop pointing the agent at the routes file. The
`list-egress-proxy-routes` tool stays available for agents that
want to see what's currently allowed.

Tests: 9 new `_merge_single_route` cases (host absent/present,
path-allowlist union+dedup, auth-slot indexing, case-insensitive
match, existing-auth preservation, missing-host rejection,
malformed-current rejection). 407 unit + integration pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/integration/test_supervise_sidecar.py

@@ -218,13 +218,13 @@ class TestSuperviseSidecar(unittest.TestCase):
         self._bring_up_sidecar()
 
         # Stub the apply step. The dashboard's approve() calls
-        # apply_routes_change to docker-exec into the egress-proxy
-        # sidecar; this test isn't exercising the real sidecar, so
-        # patch it to a no-op that returns plausible before/after
-        # strings the audit-log writer can render.
+        # add_route to docker-exec into the egress-proxy sidecar;
+        # this test isn't exercising the real sidecar, so patch it
+        # to a no-op that returns plausible before/after strings
+        # the audit-log writer can render.
         from claude_bottle.cli import dashboard as _dash
-        original_apply = _dash.apply_routes_change
-        _dash.apply_routes_change = (
+        original_apply = _dash.add_route
+        _dash.add_route = (
             lambda slug, new: ("(stubbed before)", new)
         )
 
@@ -236,7 +236,7 @@ class TestSuperviseSidecar(unittest.TestCase):
                 "params": {
                     "name": _sv.TOOL_EGRESS_PROXY_BLOCK,
                     "arguments": {
-                        "routes": '{"routes": [{"host": "api.example.com"}]}',
+                        "host": "api.example.com",
                         "justification": "integration test",
                     },
                 },
@@ -270,7 +270,7 @@ class TestSuperviseSidecar(unittest.TestCase):
             # file and returns to the curl caller.
             dashboard.approve(qp, notes="lgtm from integration test")
         finally:
-            _dash.apply_routes_change = original_apply
+            _dash.add_route = original_apply
             t.join(timeout=20)
 
         response = captured.get("response")