refactor(manifest): convert TypedDict to frozen dataclasses

Replace the TypedDict + 14 manifest_* free functions with frozen
dataclasses (SshEntry, BottleEgress, Bottle, Agent, Manifest) carrying
their own validators and constructors. Call sites import Manifest and
chain attribute access; the manifest_* helpers and manifest_validate
are gone.

Behavior changes worth flagging:
- Agent.bottle is now required (was optional with a "(none)" fallback).
  Manifest.from_json_obj dies if any agent lacks a 'bottle' field or
  references an undefined bottle, where previously start.py raised the
  error lazily for the specific agent being launched.
- ssh.py now takes SshEntry instances; Host/IdentityFile shape checks
  moved upstream into Manifest construction, leaving only the IdentityFile
  filesystem-existence check in ssh_validate_entries.
- pipelock_bottle_allowlist's per-element string check is dropped — the
  Manifest validator enforces it at load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/fixtures.py

@@ -1,4 +1,7 @@
-"""Manifest fixtures for the test suite."""
+"""Manifest fixtures for the test suite. Each fixture returns a built
+Manifest dataclass; callers that need the raw JSON shape (e.g. to write
+to a file on disk) can build it themselves or call .from_json_obj on
+a dict literal in the test."""
 
 from __future__ import annotations
 
@@ -7,9 +10,11 @@ import tempfile
 from pathlib import Path
 from typing import Any
 
+from claude_bottle.manifest import Manifest
 
-def fixture_minimal() -> dict[str, Any]:
-    """One bottle, one agent, no env / ssh / skills."""
+
+def fixture_minimal_dict() -> dict[str, Any]:
+    """One bottle, one agent, no env / ssh / skills. JSON shape."""
     return {
         "bottles": {"dev": {}},
         "agents": {
@@ -18,8 +23,8 @@ def fixture_minimal() -> dict[str, Any]:
     }
 
 
-def fixture_with_egress() -> dict[str, Any]:
-    """Bottle declares an egress.allowlist."""
+def fixture_with_egress_dict() -> dict[str, Any]:
+    """Bottle declares an egress.allowlist. JSON shape."""
     return {
         "bottles": {
             "dev": {
@@ -32,9 +37,9 @@ def fixture_with_egress() -> dict[str, Any]:
     }
 
 
-def fixture_with_ssh() -> dict[str, Any]:
+def fixture_with_ssh_dict() -> dict[str, Any]:
     """Bottle has both an IPv4-literal SSH host (CGNAT) and a hostname host,
-    exercising both ssrf.ip_allowlist and trusted_domains code paths."""
+    exercising both ssrf.ip_allowlist and trusted_domains code paths. JSON shape."""
     return {
         "bottles": {
             "dev": {
@@ -60,8 +65,22 @@ def fixture_with_ssh() -> dict[str, Any]:
     }
 
 
+def fixture_minimal() -> Manifest:
+    return Manifest.from_json_obj(fixture_minimal_dict())
+
+
+def fixture_with_egress() -> Manifest:
+    return Manifest.from_json_obj(fixture_with_egress_dict())
+
+
+def fixture_with_ssh() -> Manifest:
+    return Manifest.from_json_obj(fixture_with_ssh_dict())
+
+
 def write_fixture(fn) -> Path:
-    """Write fixture dict to a temp file; return the path. Caller must rm."""
+    """Write fixture JSON to a temp file; return the path. Caller must rm.
+    Accepts a function returning either a dict (JSON shape) or a Manifest;
+    only the dict form is supported here since we need to serialize."""
     f = tempfile.NamedTemporaryFile(
         mode="w", suffix=".json", delete=False, encoding="utf-8"
     )