test: reorganize suite into unit/integration/canaries directories

Replace the hand-maintained INTEGRATION_NAMES classifier (and the
bespoke run_tests.py around it) with a directory-driven split:

  tests/unit/         unit tests, always run
  tests/integration/  Docker-dependent, skip cleanly without Docker
  tests/canaries/     upstream-regression checks, opt-in via
                      CLAUDE_BOTTLE_RUN_CANARIES=1

The pinned-pipelock-image check moves to the canary suite — it tests
upstream packaging, not our code, so it shouldn't gate every dev push.
A scheduled canaries.yml workflow runs it weekly.

The manifest-runtime tests collapse the four assertRaises cases for
distinct 'runtime' values into one subTest loop and drop the
error-message-wording assertions; the contract is "any value is
rejected", not "the error literally contains 'auto-detect'".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/test_pipelock_classify.py

@@ -0,0 +1,33 @@
+"""Unit: is_ipv4_literal — the classifier that decides whether
+bottle.ssh[].Hostname goes into pipelock's ssrf.ip_allowlist (IPv4
+literal) or trusted_domains (hostname)."""
+
+import unittest
+
+from claude_bottle.util import is_ipv4_literal
+
+
+class TestIPv4Classify(unittest.TestCase):
+    def test_positive(self):
+        for ip in ("127.0.0.1", "10.0.0.5", "100.78.141.42", "0.0.0.0", "255.255.255.255"):
+            with self.subTest(ip=ip):
+                self.assertTrue(is_ipv4_literal(ip), ip)
+
+    def test_negative(self):
+        for hn in (
+            "github.com",
+            "gitea.dideric.is",
+            "100.78.141",
+            "100.78.141.42.5",
+            "::1",
+            "fe80::1",
+            "localhost",
+            "",
+            "1.2.3.4.example.com",
+        ):
+            with self.subTest(hn=hn):
+                self.assertFalse(is_ipv4_literal(hn), hn)
+
+
+if __name__ == "__main__":
+    unittest.main()