docs: rename CLAUDE.md to AGENTS.md and rebrand provider-agnostic

Delete CLAUDE.md in favor of AGENTS.md as the orientation doc, rebrand
the project from Codex-bottle to provider-agnostic bot-bottle, and
repoint every CLAUDE.md reference across PRDs, research notes, the
implementer agent example, and the yaml_subset comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/research/manifest-format-and-grouping.md

@@ -130,7 +130,7 @@ preserves this format.
 **Pros**
 
 - Zero migration cost.
-- Stdlib parser; no new dependency. The project's CLAUDE.md sets
+- Stdlib parser; no new dependency. The project's AGENTS.md sets
   "low dependencies by default" as a guideline.
 - Stable, predictable parse semantics. No type-coercion gotchas.
 - Tooling everywhere — IDE support, linters, jq.
@@ -162,7 +162,7 @@ ruamel.yaml).
 
 - **New runtime dependency.** The project today uses zero
   third-party Python packages for production code; YAML parsing
-  pulls in PyYAML. (CLAUDE.md: "Python, stdlib-first; low-deps by default.")
+  pulls in PyYAML. (AGENTS.md: "Python, stdlib-first; low-deps by default.")
 - YAML's footguns: indentation sensitivity, the Norway problem
   (`country: NO` → boolean False), implicit type coercion that's
   surprised non-trivial production projects.

docs/research/network-egress-guard.md

@@ -734,7 +734,7 @@ Key PRD scope for this work:
 - Add a dnsmasq configuration step: install dnsmasq in the Dockerfile, configure
   it to serve only allowlisted names, and set `--dns 127.0.0.1` in `docker run`.
 - Block outbound UDP port 53 to non-dnsmasq resolvers in the iptables rules.
-- Document the `--cap-add` changes in `CLAUDE.md` under security.
+- Document the `--cap-add` changes in `AGENTS.md` under security.
 
 ### Tier 2 (v2, higher isolation): smokescreen sidecar
 

docs/research/pipelock-assessment.md

@@ -486,7 +486,7 @@ plausibly run pipelock on the host and skip Docker entirely.
 ### Where bot-bottle does work pipelock does not
 
 The redundancy argument breaks down once the actual goals from
-`CLAUDE.md` are enumerated:
+`AGENTS.md` are enumerated:
 
 1. **Filesystem isolation that survives a misbehaving agent.** Docker
    containers give an entire kernel-mediated mount namespace and a separate
@@ -584,7 +584,7 @@ some other way. That is not the use case the project was built for.
 
 2. **Does the pipelock Docker image introduce supply-chain risk?**
    Pulling `ghcr.io/luckypipewrench/pipelock:latest` brings in a binary
-   from an unvetted source. Pinning by digest (as the CLAUDE.md recommends
+   from an unvetted source. Pinning by digest (as the AGENTS.md recommends
    for supply-chain hygiene) and building from source are both options.
 
 3. **What is the actual DLP false-positive rate for the secrets bot-bottle

docs/research/stronger-isolation-alternatives.md

@@ -223,7 +223,7 @@ scope and the manifest example carries `/Users/didericis` paths:
    right v2.
 3. **Firecracker only if** bot-bottle's deployment target settles on
    self-hosted Linux, not laptops — at which point the "non-goal:
-   self-hosted VMs" line in `CLAUDE.md` flips and the project's
+   self-hosted VMs" line in `AGENTS.md` flips and the project's
    identity changes.
 
 The pipelock egress design ports across all of these, so none of this