refactor(manifest): convert TypedDict to frozen dataclasses

Replace the TypedDict + 14 manifest_* free functions with frozen
dataclasses (SshEntry, BottleEgress, Bottle, Agent, Manifest) carrying
their own validators and constructors. Call sites import Manifest and
chain attribute access; the manifest_* helpers and manifest_validate
are gone.

Behavior changes worth flagging:
- Agent.bottle is now required (was optional with a "(none)" fallback).
  Manifest.from_json_obj dies if any agent lacks a 'bottle' field or
  references an undefined bottle, where previously start.py raised the
  error lazily for the specific agent being launched.
- ssh.py now takes SshEntry instances; Host/IdentityFile shape checks
  moved upstream into Manifest construction, leaving only the IdentityFile
  filesystem-existence check in ssh_validate_entries.
- pipelock_bottle_allowlist's per-element string check is dropped — the
  Manifest validator enforces it at load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/env_resolve.py

@@ -35,7 +35,7 @@ import sys
 from pathlib import Path
 
 from .log import die
-from .manifest import Manifest, manifest_env_entry, manifest_env_names
+from .manifest import Manifest
 
 _INTERPOLATED_RE = re.compile(r"^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$")
 
@@ -108,10 +108,10 @@ def env_resolve(
       - interpolated: copy host value; export under target name; append `-e NAME`
       - literal:      append `NAME=VALUE` to env_file
     """
-    for name in manifest_env_names(manifest, agent):
+    bottle = manifest.bottle_for(agent)
+    for name, raw in bottle.env.items():
         if not name:
             continue
-        raw = manifest_env_entry(manifest, agent, name)
         kind = env_entry_kind(raw)
         if kind == "secret":
             prompt_body = env_entry_secret_prompt(raw)