test: reorganize suite into unit/integration/canaries directories

Replace the hand-maintained INTEGRATION_NAMES classifier (and the
bespoke run_tests.py around it) with a directory-driven split:

  tests/unit/         unit tests, always run
  tests/integration/  Docker-dependent, skip cleanly without Docker
  tests/canaries/     upstream-regression checks, opt-in via
                      CLAUDE_BOTTLE_RUN_CANARIES=1

The pinned-pipelock-image check moves to the canary suite — it tests
upstream packaging, not our code, so it shouldn't gate every dev push.
A scheduled canaries.yml workflow runs it weekly.

The manifest-runtime tests collapse the four assertRaises cases for
distinct 'runtime' values into one subTest loop and drop the
error-message-wording assertions; the contract is "any value is
rejected", not "the error literally contains 'auto-detect'".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/test_pipelock_allowlist.py

@@ -0,0 +1,82 @@
+"""Unit: allowlist resolution — pipelock_bottle_allowlist,
+pipelock_bottle_ssh_hostnames, pipelock_bottle_ssh_ip_cidrs,
+pipelock_bottle_ssh_trusted_domains, pipelock_effective_allowlist."""
+
+import unittest
+
+from claude_bottle.log import Die
+from claude_bottle.manifest import Manifest
+from claude_bottle.pipelock import (
+    pipelock_bottle_allowlist,
+    pipelock_bottle_ssh_hostnames,
+    pipelock_bottle_ssh_ip_cidrs,
+    pipelock_bottle_ssh_trusted_domains,
+    pipelock_effective_allowlist,
+)
+from tests.fixtures import fixture_minimal, fixture_with_egress, fixture_with_ssh
+
+
+class TestBottleAllowlist(unittest.TestCase):
+    def test_egress_allowlist_present(self):
+        out = pipelock_bottle_allowlist(fixture_with_egress().bottles["dev"])
+        self.assertIn("github.com", out)
+        self.assertIn("gitlab.com", out)
+        self.assertIn("registry.npmjs.org", out)
+
+    def test_empty_when_no_egress_block(self):
+        out = pipelock_bottle_allowlist(fixture_minimal().bottles["dev"])
+        self.assertEqual([], out)
+
+    def test_rejects_non_string_entry(self):
+        bad = {
+            "bottles": {"dev": {"egress": {"allowlist": ["github.com", 42]}}},
+            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+        }
+        with self.assertRaises(Die):
+            Manifest.from_json_obj(bad)
+
+
+class TestSSHHostnames(unittest.TestCase):
+    def test_hostnames_include_both(self):
+        hosts = pipelock_bottle_ssh_hostnames(fixture_with_ssh().bottles["dev"])
+        self.assertIn("100.78.141.42", hosts)
+        self.assertIn("github.com", hosts)
+
+    def test_ip_cidrs_only_ipv4(self):
+        cidrs = pipelock_bottle_ssh_ip_cidrs(fixture_with_ssh().bottles["dev"])
+        self.assertIn("100.78.141.42/32", cidrs)
+        self.assertNotIn("github.com", cidrs)
+
+    def test_trusted_domains_only_hostnames(self):
+        trusted = pipelock_bottle_ssh_trusted_domains(fixture_with_ssh().bottles["dev"])
+        self.assertIn("github.com", trusted)
+        self.assertNotIn("100.78.141.42", trusted)
+
+
+class TestEffectiveAllowlist(unittest.TestCase):
+    def test_union_and_dedup(self):
+        manifest = Manifest.from_json_obj({
+            "bottles": {
+                "dev": {
+                    "egress": {"allowlist": ["registry.npmjs.org"]},
+                    "ssh": [
+                        {"Host": "ts", "IdentityFile": "/dev/null",
+                         "Hostname": "100.78.141.42", "User": "git", "Port": 30009},
+                        {"Host": "gh", "IdentityFile": "/dev/null",
+                         "Hostname": "github.com", "User": "git", "Port": 22},
+                    ],
+                }
+            },
+            "agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
+        })
+        eff = pipelock_effective_allowlist(manifest.bottles["dev"])
+        self.assertIn("api.anthropic.com", eff)
+        self.assertIn("registry.npmjs.org", eff)
+        self.assertIn("100.78.141.42", eff)
+        self.assertIn("github.com", eff)
+        self.assertEqual(len(eff), len(set(eff)), "deduplicated")
+        self.assertEqual(eff, sorted(eff), "sorted")
+
+
+if __name__ == "__main__":
+    unittest.main()