refactor: convert project from bash to Python

Replaces cli.sh + lib/*.sh with a claude_bottle/ Python package and a
cli.py entry point. No external dependencies — uses only Python's
stdlib (json, subprocess, getpass, tempfile, argparse, re, etc.).

- claude_bottle/{log,docker,manifest,env_resolve,network,pipelock,
  skills,ssh,cli}.py mirror the previous lib/*.sh modules.
- Tests converted to unittest under tests/test_*.py with a stdlib
  runner at tests/run_tests.py (unit | integration | path).
- .githooks/commit-msg ported to Python; same Conventional Commits rules.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/fixtures.py

@@ -0,0 +1,70 @@
+"""Manifest fixtures for the test suite."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+from pathlib import Path
+from typing import Any
+
+
+def fixture_minimal() -> dict[str, Any]:
+    """One bottle, one agent, no env / ssh / skills."""
+    return {
+        "bottles": {"dev": {}},
+        "agents": {
+            "demo": {"skills": [], "prompt": "", "bottle": "dev"},
+        },
+    }
+
+
+def fixture_with_egress() -> dict[str, Any]:
+    """Bottle declares an egress.allowlist."""
+    return {
+        "bottles": {
+            "dev": {
+                "egress": {
+                    "allowlist": ["github.com", "gitlab.com", "registry.npmjs.org"]
+                }
+            }
+        },
+        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+    }
+
+
+def fixture_with_ssh() -> dict[str, Any]:
+    """Bottle has both an IPv4-literal SSH host (CGNAT) and a hostname host,
+    exercising both ssrf.ip_allowlist and trusted_domains code paths."""
+    return {
+        "bottles": {
+            "dev": {
+                "ssh": [
+                    {
+                        "Host": "tailscale-gitea",
+                        "IdentityFile": "/dev/null",
+                        "Hostname": "100.78.141.42",
+                        "User": "git",
+                        "Port": 30009,
+                    },
+                    {
+                        "Host": "github",
+                        "IdentityFile": "/dev/null",
+                        "Hostname": "github.com",
+                        "User": "git",
+                        "Port": 22,
+                    },
+                ]
+            }
+        },
+        "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+    }
+
+
+def write_fixture(fn) -> Path:
+    """Write fixture dict to a temp file; return the path. Caller must rm."""
+    f = tempfile.NamedTemporaryFile(
+        mode="w", suffix=".json", delete=False, encoding="utf-8"
+    )
+    json.dump(fn(), f)
+    f.close()
+    return Path(f.name)