test: drop ssh-gate suites and shadow-route assertions (PRD 0009)

- Delete tests/unit/test_ssh_gate.py and the fixture_with_ssh helpers.
- test_pipelock_yaml: drop the ssh-leak guard (structurally
  impossible now); the remaining tests switch to fixture_minimal.
- test_pipelock_allowlist: rewrite the union/dedup test to
  exercise an egress.allowlist that duplicates a baked default
  (the property the ssh-leak assertion was hitching onto).
- test_manifest_git: shadow-route assertion becomes a legacy-ssh-
  dies-with-hint assertion, since bottle.ssh is now parse-fail.
- test_orphan_cleanup: drop the SSHGate.stop idempotency check;
  pipelock equivalent stays.
- test_dry_run_plan: drop assertions on the removed ssh_hosts /
  ssh_gate keys.

52 unit tests pass.

tests/unit/test_pipelock_allowlist.py

@@ -1,7 +1,6 @@
 """Unit: pipelock_effective_allowlist — the union of baked-in defaults
-and bottle.egress.allowlist. Per PRD 0007, bottle.ssh entries do NOT
-contribute (SSH traffic goes through the per-agent ssh-gate, not
-pipelock)."""
+and bottle.egress.allowlist. Git upstreams declared in bottle.git do not
+contribute here; they flow through the per-agent git-gate (PRD 0008)."""
 
 import unittest
 
@@ -14,25 +13,21 @@ class TestEffectiveAllowlist(unittest.TestCase):
         manifest = Manifest.from_json_obj({
             "bottles": {
                 "dev": {
-                    "egress": {"allowlist": ["registry.npmjs.org"]},
-                    "ssh": [
-                        {"Host": "ts", "IdentityFile": "/dev/null",
-                         "Hostname": "100.78.141.42", "User": "git", "Port": 30009},
-                        {"Host": "gh", "IdentityFile": "/dev/null",
-                         "Hostname": "github.com", "User": "git", "Port": 22},
-                    ],
-                }
+                    "egress": {
+                        "allowlist": [
+                            "registry.npmjs.org",
+                            # Duplicate of a baked default; the union
+                            # must dedupe.
+                            "api.anthropic.com",
+                        ],
+                    },
+                },
             },
             "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
         })
         eff = pipelock_effective_allowlist(manifest.bottles["dev"])
         self.assertIn("api.anthropic.com", eff, "baked default present")
         self.assertIn("registry.npmjs.org", eff, "egress.allowlist present")
-        # PRD 0007: ssh hostnames must not contribute to pipelock's
-        # allowlist anymore — they're routed through the ssh-gate
-        # sidecar, which is on its own egress path.
-        self.assertNotIn("100.78.141.42", eff)
-        self.assertNotIn("github.com", eff)
         self.assertEqual(len(eff), len(set(eff)), "deduplicated")
         self.assertEqual(eff, sorted(eff), "sorted")