refactor: convert project from bash to Python

Replaces cli.sh + lib/*.sh with a claude_bottle/ Python package and a
cli.py entry point. No external dependencies — uses only Python's
stdlib (json, subprocess, getpass, tempfile, argparse, re, etc.).

- claude_bottle/{log,docker,manifest,env_resolve,network,pipelock,
  skills,ssh,cli}.py mirror the previous lib/*.sh modules.
- Tests converted to unittest under tests/test_*.py with a stdlib
  runner at tests/run_tests.py (unit | integration | path).
- .githooks/commit-msg ported to Python; same Conventional Commits rules.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_orphan_cleanup.py

@@ -0,0 +1,70 @@
+"""Integration: the cleanup primitives the start-flow trap depends on
+are idempotent. The original orphan-network bug was a trap-ordering
+issue; the fix moved the install earlier. The trap is only safe if
+network_remove and pipelock_stop are no-ops against missing resources."""
+
+import os
+import subprocess
+import unittest
+
+from claude_bottle.network import (
+    network_create_egress,
+    network_create_internal,
+    network_remove,
+)
+from claude_bottle.pipelock import pipelock_stop
+from tests._docker import skip_unless_docker
+
+
+@skip_unless_docker()
+class TestOrphanCleanup(unittest.TestCase):
+    def setUp(self):
+        self.slug = f"cb-test-orphan-{os.getpid()}"
+        self.internal_name = ""
+        self.egress_name = ""
+
+    def tearDown(self):
+        for n in (self.internal_name, self.egress_name):
+            if n:
+                subprocess.run(
+                    ["docker", "network", "rm", n],
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL,
+                )
+
+    def test_remove_missing_is_noop(self):
+        # Returning True == idempotent success.
+        self.assertTrue(network_remove(f"claude-bottle-net-{self.slug}-does-not-exist"))
+
+    def test_create_and_remove(self):
+        self.internal_name = network_create_internal(self.slug)
+        self.egress_name = network_create_egress(self.slug)
+
+        nets = subprocess.run(
+            ["docker", "network", "ls", "--format", "{{.Name}}"],
+            capture_output=True, text=True,
+        ).stdout.splitlines()
+        self.assertIn(self.internal_name, nets)
+        self.assertIn(self.egress_name, nets)
+
+        self.assertTrue(network_remove(self.internal_name))
+        self.assertTrue(network_remove(self.egress_name))
+
+        nets_after = subprocess.run(
+            ["docker", "network", "ls", "--format", "{{.Name}}"],
+            capture_output=True, text=True,
+        ).stdout.splitlines()
+        self.assertNotIn(self.internal_name, nets_after)
+        self.assertNotIn(self.egress_name, nets_after)
+
+        # Idempotent on already-removed.
+        self.assertTrue(network_remove(self.internal_name))
+        self.assertTrue(network_remove(self.egress_name))
+
+    def test_pipelock_stop_missing_sidecar(self):
+        # Should not raise.
+        pipelock_stop(f"missing-{self.slug}")
+
+
+if __name__ == "__main__":
+    unittest.main()