test(sidecars): integration sweep for the bundle path (PRD 0024 chunk 4)

Three deliverables:

1. Rewrite test_pipelock_apply bringup with a direct `docker run`.
   Replaces the .start-based bringup deleted in chunk 3. Stages
   the yaml + CAs to the real pipelock_state_dir so the bind-
   mount target matches what apply_allowlist_change writes to —
   the legacy .start path did this implicitly because it lived
   inside the production flow; the new bringup needs to be
   explicit about the path. All 4 cases pass.

2. New tests/integration/test_sidecar_bundle_compose.py: end-
   to-end smoke with CLAUDE_BOTTLE_SIDECAR_BUNDLE=1. Brings up
   a real bottle via the compose path and verifies the agent
   can reach pipelock + supervise through the bundle's legacy
   aliases (no agent-side config changes between flag positions).
   Skipped under act_runner — multi-stage build + bind mounts.

3. Two bundle-path bugs surfaced and fixed while running PRD
   0022 with the flag on:

   - egress_entrypoint.sh: add `--set confdir=/home/mitmproxy/
     .mitmproxy` so mitmdump finds the bind-mounted CA. The
     legacy Dockerfile.egress runs as user mitmproxy (~mitmproxy
     resolves correctly); the bundle runs as root and otherwise
     would look in /root/.mitmproxy/ and mint a NEW CA the agent
     doesn't trust. Symptom: PRD 0022 attack-3 curl failed with
     "unable to get local issuer certificate".

   - sidecar_init.py: add `--listen 0.0.0.0:8888` to pipelock's
     argv. Without it pipelock defaults to 127.0.0.1, so the
     in-bundle egress's upstream connect to the
     `claude-bottle-pipelock-<slug>` alias arrives over the
     docker network and gets refused. The legacy renderer
     passed this flag verbatim; the bundle dropped it. Symptom:
     egress returned HTTP 502 with "Connect call failed
     ('172.x.x.x', 8888)".

   PRD 0022's 5-attack sandbox-escape suite now passes with the
   bundle flag on AND off.

Test status:
- Unit: 533 passing.
- Integration: 9 passing locally with flag off, 5 passing with
  flag on. Bundle compose smoke + PRD 0022 sandbox-escape both
  green under CLAUDE_BOTTLE_SIDECAR_BUNDLE=1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_entrypoint.sh

@@ -20,6 +20,17 @@
 
 set -e
 
+# Pin mitmproxy's config dir to the bind-mount location of its CA
+# regardless of which user mitmdump runs as. In the legacy
+# four-sidecar setup (Dockerfile.egress, USER mitmproxy) this
+# resolved naturally to `~mitmproxy/.mitmproxy`. In the PRD 0024
+# bundle (USER root) `~root/.mitmproxy` is empty, so without this
+# flag mitmdump would generate a fresh CA on the wrong path and
+# the agent's installed trust anchor would no longer match the
+# bumped leaf certs.
+CONFDIR=/home/mitmproxy/.mitmproxy
+CONFDIR_FLAG="--set confdir=$CONFDIR"
+
 MODE="--mode regular@9099"
 if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
   MODE="--mode upstream:$EGRESS_UPSTREAM_PROXY --listen-port 9099"
@@ -27,7 +38,7 @@ fi
 
 TRUST_FLAG=""
 if [ -n "$EGRESS_UPSTREAM_CA" ] && [ -f "$EGRESS_UPSTREAM_CA" ]; then
-  COMBINED=/home/mitmproxy/.mitmproxy/combined-trust.pem
+  COMBINED=$CONFDIR/combined-trust.pem
   cat /etc/ssl/certs/ca-certificates.crt "$EGRESS_UPSTREAM_CA" > "$COMBINED"
   TRUST_FLAG="--set ssl_verify_upstream_trusted_ca=$COMBINED"
 fi
@@ -46,4 +57,4 @@ if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
   export NO_PROXY="localhost,127.0.0.1"
 fi
 
-exec mitmdump $MODE $TRUST_FLAG -s /app/egress_addon.py
+exec mitmdump $CONFDIR_FLAG $MODE $TRUST_FLAG -s /app/egress_addon.py

claude_bottle/sidecar_init.py

@@ -57,11 +57,18 @@ class _DaemonSpec:
 # Order matters only for first-launch race-window reasons: egress
 # starts first so pipelock's upstream connect succeeds during
 # pipelock's own startup. git-gate and supervise are independent.
+# Pipelock binds 0.0.0.0:8888 explicitly. Without `--listen` it
+# defaults to 127.0.0.1 which would be unreachable from sibling
+# services on the docker network. The legacy four-sidecar
+# compose renderer passed the same flag; the bundle keeps the
+# explicit binding.
 _DAEMONS: tuple[_DaemonSpec, ...] = (
     _DaemonSpec("egress", ("/bin/sh", "/app/egress-entrypoint.sh")),
     _DaemonSpec(
         "pipelock",
-        ("/usr/local/bin/pipelock", "run", "--config", "/etc/pipelock.yaml"),
+        ("/usr/local/bin/pipelock", "run",
+         "--config", "/etc/pipelock.yaml",
+         "--listen", "0.0.0.0:8888"),
     ),
     _DaemonSpec("git-gate", ("/bin/sh", "/git-gate-entrypoint.sh")),
     _DaemonSpec("supervise", ("python3", "/app/supervise_server.py")),