refactor: export applicator singletons from egress_apply backends

Replace module-level apply_routes_change wrappers with a public
applicator singleton in each backend. Callers now work with the
EgressApplicator instance directly (applicator.apply_routes_change)
rather than through a function shim.

bot_bottle/backend/docker/egress_apply.py

@@ -49,20 +49,12 @@ class DockerEgressApplicator(EgressApplicator):
             )
 
 
-_applicator = DockerEgressApplicator()
-
-
-def apply_routes_change(slug: str, content: str) -> tuple[str, str]:
-    return _applicator.apply_routes_change(slug, content)
-
-
-validate_routes_content = EgressApplicator.validate_routes_content
+applicator = DockerEgressApplicator()
 
 
 __all__ = [
     "DockerEgressApplicator",
     "EgressApplyError",
-    "apply_routes_change",
+    "applicator",
     "fetch_current_routes",
-    "validate_routes_content",
 ]

bot_bottle/backend/macos_container/egress_apply.py

@@ -33,11 +33,7 @@ class MacOSContainerEgressApplicator(EgressApplicator):
             )
 
 
-_applicator = MacOSContainerEgressApplicator()
+applicator = MacOSContainerEgressApplicator()
 
 
-def apply_routes_change(slug: str, content: str) -> tuple[str, str]:
-    return _applicator.apply_routes_change(slug, content)
-
-
-__all__ = ["MacOSContainerEgressApplicator", "EgressApplyError", "apply_routes_change"]
+__all__ = ["MacOSContainerEgressApplicator", "EgressApplyError", "applicator"]

bot_bottle/backend/smolmachines/egress_apply.py

@@ -7,15 +7,15 @@ so egress signalling is identical to the docker backend.
 from __future__ import annotations
 
 from ..docker.egress_apply import (  # noqa: F401
+    DockerEgressApplicator,
     EgressApplyError,
-    apply_routes_change,
+    applicator,
     fetch_current_routes,
-    validate_routes_content,
 )
 
 __all__ = [
+    "DockerEgressApplicator",
     "EgressApplyError",
-    "apply_routes_change",
+    "applicator",
     "fetch_current_routes",
-    "validate_routes_content",
 ]

bot_bottle/cli/supervise.py

@@ -28,13 +28,13 @@ from ..bottle_state import read_metadata
 # )
 from ..backend.docker.egress_apply import (
     EgressApplyError,
-    apply_routes_change as _docker_apply_routes_change,
+    applicator as _docker_applicator,
 )
 from ..backend.macos_container.egress_apply import (
-    apply_routes_change as _macos_apply_routes_change,
+    applicator as _macos_applicator,
 )
 from ..backend.smolmachines.egress_apply import (
-    apply_routes_change as _smolmachines_apply_routes_change,
+    applicator as _smolmachines_applicator,
 )
 from ..log import Die, error, info
 
@@ -83,10 +83,10 @@ def apply_routes_change(slug: str, content: str) -> tuple[str, str]:
     meta = read_metadata(slug)
     backend = meta.backend if meta is not None else ""
     if backend == "macos-container":
-        return _macos_apply_routes_change(slug, content)
+        return _macos_applicator.apply_routes_change(slug, content)
     if backend == "smolmachines":
-        return _smolmachines_apply_routes_change(slug, content)
-    return _docker_apply_routes_change(slug, content)
+        return _smolmachines_applicator.apply_routes_change(slug, content)
+    return _docker_applicator.apply_routes_change(slug, content)
 
 
 def discover_pending() -> list[QueuedProposal]:

tests/unit/test_egress_apply.py

@@ -9,11 +9,8 @@ from types import SimpleNamespace
 from unittest.mock import patch
 
 from bot_bottle import supervise
-from bot_bottle.backend.docker.egress_apply import (
-    EgressApplyError,
-    apply_routes_change,
-    validate_routes_content,
-)
+from bot_bottle.backend.egress_apply import EgressApplyError
+from bot_bottle.backend.docker.egress_apply import applicator
 
 
 _ROUTES_EMPTY = "routes: []\n"
@@ -22,11 +19,11 @@ _ROUTES_ONE = 'routes:\n  - host: "api.anthropic.com"\n'
 
 class TestValidateRoutesContent(unittest.TestCase):
     def test_accepts_minimal_route_table(self):
-        validate_routes_content(_ROUTES_EMPTY)
-        validate_routes_content(_ROUTES_ONE)
+        applicator.validate_routes_content(_ROUTES_EMPTY)
+        applicator.validate_routes_content(_ROUTES_ONE)
 
     def test_accepts_full_route_with_matches(self):
-        validate_routes_content(
+        applicator.validate_routes_content(
             'routes:\n'
             '  - host: "api.github.com"\n'
             '    auth_scheme: "Bearer"\n'
@@ -38,20 +35,20 @@ class TestValidateRoutesContent(unittest.TestCase):
 
     def test_rejects_bad_yaml(self):
         with self.assertRaises(EgressApplyError) as cm:
-            validate_routes_content("routes:\n\t- host: x\n")
+            applicator.validate_routes_content("routes:\n\t- host: x\n")
         self.assertIn("not valid", str(cm.exception))
 
     def test_rejects_missing_routes_key(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content("other: []\n")
+            applicator.validate_routes_content("other: []\n")
 
     def test_rejects_non_list_routes(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content('routes: "not a list"\n')
+            applicator.validate_routes_content('routes: "not a list"\n')
 
     def test_rejects_partial_auth_pair(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content(
+            applicator.validate_routes_content(
                 'routes:\n'
                 '  - host: "x.example"\n'
                 '    auth_scheme: "Bearer"\n'
@@ -81,7 +78,7 @@ class TestApplyRoutesChange(unittest.TestCase):
             "bot_bottle.backend.docker.egress_apply.subprocess.run",
             side_effect=fake_run,
         ):
-            before, after = apply_routes_change(
+            before, after = applicator.apply_routes_change(
                 "dev",
                 "routes:\n  - host: google.com\n",
             )