refactor: convert project from bash to Python

Replaces cli.sh + lib/*.sh with a claude_bottle/ Python package and a
cli.py entry point. No external dependencies — uses only Python's
stdlib (json, subprocess, getpass, tempfile, argparse, re, etc.).

- claude_bottle/{log,docker,manifest,env_resolve,network,pipelock,
  skills,ssh,cli}.py mirror the previous lib/*.sh modules.
- Tests converted to unittest under tests/test_*.py with a stdlib
  runner at tests/run_tests.py (unit | integration | path).
- .githooks/commit-msg ported to Python; same Conventional Commits rules.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_pipelock_image.py

@@ -0,0 +1,55 @@
+"""Integration: verify the pinned pipelock image. Requires docker.
+  - Pinned digest is reachable on the registry.
+  - Image's ENTRYPOINT/CMD match what claude_bottle.pipelock assumes
+    (`/pipelock` and `run --listen 0.0.0.0:8888`).
+  - The /pipelock binary actually runs (--version succeeds)."""
+
+import json
+import re
+import subprocess
+import unittest
+
+from claude_bottle.pipelock import PIPELOCK_IMAGE
+from tests._docker import skip_unless_docker
+
+
+@skip_unless_docker()
+class TestPipelockImage(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        # Pull the pinned image (cheap if cached).
+        result = subprocess.run(
+            ["docker", "pull", PIPELOCK_IMAGE],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        if result.returncode != 0:
+            raise unittest.SkipTest(f"could not pull {PIPELOCK_IMAGE}")
+
+    def test_entrypoint_contains_pipelock(self):
+        result = subprocess.run(
+            ["docker", "image", "inspect", PIPELOCK_IMAGE,
+             "--format", "{{json .Config.Entrypoint}}"],
+            capture_output=True, text=True,
+        )
+        self.assertIn("/pipelock", result.stdout)
+
+    def test_cmd_contains_run(self):
+        result = subprocess.run(
+            ["docker", "image", "inspect", PIPELOCK_IMAGE,
+             "--format", "{{json .Config.Cmd}}"],
+            capture_output=True, text=True,
+        )
+        self.assertIn("run", result.stdout)
+
+    def test_binary_runs(self):
+        result = subprocess.run(
+            ["docker", "run", "--rm", PIPELOCK_IMAGE, "--version"],
+            capture_output=True, text=True,
+        )
+        out = result.stdout + result.stderr
+        self.assertRegex(out, r"[Pp]ipelock|2\.[0-9]+\.[0-9]+")
+
+
+if __name__ == "__main__":
+    unittest.main()