refactor(manifest): convert TypedDict to frozen dataclasses

Replace the TypedDict + 14 manifest_* free functions with frozen
dataclasses (SshEntry, BottleEgress, Bottle, Agent, Manifest) carrying
their own validators and constructors. Call sites import Manifest and
chain attribute access; the manifest_* helpers and manifest_validate
are gone.

Behavior changes worth flagging:
- Agent.bottle is now required (was optional with a "(none)" fallback).
  Manifest.from_json_obj dies if any agent lacks a 'bottle' field or
  references an undefined bottle, where previously start.py raised the
  error lazily for the specific agent being launched.
- ssh.py now takes SshEntry instances; Host/IdentityFile shape checks
  moved upstream into Manifest construction, leaving only the IdentityFile
  filesystem-existence check in ssh_validate_entries.
- pipelock_bottle_allowlist's per-element string check is dropped — the
  Manifest validator enforces it at load.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_pipelock_yaml.py

@@ -7,6 +7,7 @@ import tempfile
 import unittest
 from pathlib import Path
 
+from claude_bottle.manifest import Manifest
 from claude_bottle.pipelock import pipelock_write_yaml
 from tests.fixtures import fixture_minimal, fixture_with_ssh
 
@@ -50,7 +51,7 @@ class TestPipelockYaml(unittest.TestCase):
         self.assertIn("100.78.141.42", content)
 
     def test_secret_hygiene(self):
-        manifest = {
+        manifest = Manifest.from_json_obj({
             "bottles": {
                 "dev": {
                     "env": {
@@ -61,7 +62,7 @@ class TestPipelockYaml(unittest.TestCase):
                 }
             },
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
-        }
+        })
         yaml_path = self.out_dir / "secret.yaml"
         pipelock_write_yaml(manifest, "dev", yaml_path)
         content = yaml_path.read_text()