refactor(pipelock): introduce PipelockProxy class housing the yaml body

The YAML generation now lives on PipelockProxy.prepare(manifest,
bottle_name, yaml_path) in claude_bottle/pipelock.py. The class is the
natural home for any future proxy-level state.

DockerBottleBackend keeps an instance as a class attribute
(_proxy = PipelockProxy()) and its prepare_proxy becomes a thin
delegation. A future backend that wants a different egress proxy
(or none) plugs in its own strategy.

Tests retarget at the new home — PipelockProxy.prepare gets the
content-shape assertions; the sidecar smoke test uses the class
directly too. Same coverage.

tests/test_pipelock_sidecar_smoke.py

@@ -12,9 +12,7 @@ import unittest
 import urllib.request
 from pathlib import Path
 
-from claude_bottle.backend import BottleSpec
-from claude_bottle.backend.docker import DockerBottleBackend
-from claude_bottle.pipelock import PIPELOCK_IMAGE
+from claude_bottle.pipelock import PIPELOCK_IMAGE, PipelockProxy
 from tests._docker import skip_unless_docker
 from tests.fixtures import fixture_minimal
 
@@ -40,14 +38,7 @@ class TestPipelockSidecarSmoke(unittest.TestCase):
     )
     def test_smoke(self):
         yaml_path = self.work_dir / "pipelock.yaml"
-        spec = BottleSpec(
-            manifest=fixture_minimal(),
-            agent_name="demo",
-            copy_cwd=False,
-            user_cwd="/tmp",
-            forward_oauth_token=False,
-        )
-        DockerBottleBackend().prepare_proxy(spec, yaml_path)
+        PipelockProxy().prepare(fixture_minimal(), "dev", yaml_path)
 
         create = subprocess.run(
             [