refactor: convert project from bash to Python

Replaces cli.sh + lib/*.sh with a claude_bottle/ Python package and a
cli.py entry point. No external dependencies — uses only Python's
stdlib (json, subprocess, getpass, tempfile, argparse, re, etc.).

- claude_bottle/{log,docker,manifest,env_resolve,network,pipelock,
  skills,ssh,cli}.py mirror the previous lib/*.sh modules.
- Tests converted to unittest under tests/test_*.py with a stdlib
  runner at tests/run_tests.py (unit | integration | path).
- .githooks/commit-msg ported to Python; same Conventional Commits rules.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_pipelock_allowlist.py

@@ -0,0 +1,81 @@
+"""Unit: allowlist resolution — pipelock_bottle_allowlist,
+pipelock_bottle_ssh_hostnames, pipelock_bottle_ssh_ip_cidrs,
+pipelock_bottle_ssh_trusted_domains, pipelock_effective_allowlist."""
+
+import unittest
+
+from claude_bottle.log import Die
+from claude_bottle.pipelock import (
+    pipelock_bottle_allowlist,
+    pipelock_bottle_ssh_hostnames,
+    pipelock_bottle_ssh_ip_cidrs,
+    pipelock_bottle_ssh_trusted_domains,
+    pipelock_effective_allowlist,
+)
+from tests.fixtures import fixture_minimal, fixture_with_egress, fixture_with_ssh
+
+
+class TestBottleAllowlist(unittest.TestCase):
+    def test_egress_allowlist_present(self):
+        out = pipelock_bottle_allowlist(fixture_with_egress(), "dev")
+        self.assertIn("github.com", out)
+        self.assertIn("gitlab.com", out)
+        self.assertIn("registry.npmjs.org", out)
+
+    def test_empty_when_no_egress_block(self):
+        out = pipelock_bottle_allowlist(fixture_minimal(), "dev")
+        self.assertEqual([], out)
+
+    def test_rejects_non_string_entry(self):
+        bad = {
+            "bottles": {"dev": {"egress": {"allowlist": ["github.com", 42]}}},
+            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+        }
+        with self.assertRaises(Die):
+            pipelock_bottle_allowlist(bad, "dev")
+
+
+class TestSSHHostnames(unittest.TestCase):
+    def test_hostnames_include_both(self):
+        hosts = pipelock_bottle_ssh_hostnames(fixture_with_ssh(), "dev")
+        self.assertIn("100.78.141.42", hosts)
+        self.assertIn("github.com", hosts)
+
+    def test_ip_cidrs_only_ipv4(self):
+        cidrs = pipelock_bottle_ssh_ip_cidrs(fixture_with_ssh(), "dev")
+        self.assertIn("100.78.141.42/32", cidrs)
+        self.assertNotIn("github.com", cidrs)
+
+    def test_trusted_domains_only_hostnames(self):
+        trusted = pipelock_bottle_ssh_trusted_domains(fixture_with_ssh(), "dev")
+        self.assertIn("github.com", trusted)
+        self.assertNotIn("100.78.141.42", trusted)
+
+
+class TestEffectiveAllowlist(unittest.TestCase):
+    def test_union_and_dedup(self):
+        manifest = {
+            "bottles": {
+                "dev": {
+                    "egress": {"allowlist": ["registry.npmjs.org"]},
+                    "ssh": [
+                        {"Host": "ts", "IdentityFile": "/dev/null",
+                         "Hostname": "100.78.141.42", "User": "git", "Port": 30009},
+                        {"Host": "gh", "IdentityFile": "/dev/null",
+                         "Hostname": "github.com", "User": "git", "Port": 22},
+                    ],
+                }
+            },
+            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+        }
+        eff = pipelock_effective_allowlist(manifest, "dev")
+        self.assertIn("api.anthropic.com", eff)
+        self.assertIn("registry.npmjs.org", eff)
+        self.assertIn("100.78.141.42", eff)
+        self.assertIn("github.com", eff)
+        self.assertEqual(len(eff), len(set(eff)), "deduplicated")
+        self.assertEqual(eff, sorted(eff), "sorted")
+
+
+if __name__ == "__main__":
+    unittest.main()