refactor(sidecars): bundle is the only shape (PRD 0024 chunk 5)

The CLAUDE_BOTTLE_SIDECAR_BUNDLE feature flag is gone. Every
bottle ships with the agent + bundle pair — no opt-in, no legacy
four-sidecar fallback.

Changes:

- Renderer (compose.py): bottle_plan_to_compose unconditionally
  emits {agent, sidecars}. Deleted _pipelock_service,
  _git_gate_service, _egress_service, _supervise_service helpers.
  _agent_service.depends_on collapses to ["sidecars"].

- sidecar_bundle.py: deleted sidecar_bundle_enabled (the flag
  parser). SIDECAR_BUNDLE_IMAGE + container-name helper stay.

- pipelock_apply.py: docker cp + docker restart now target
  sidecar_bundle_container_name(slug). Bundle restart bounces
  all four daemons together (per-daemon reload is the eventual
  feature, not v1).

- Per-sidecar modules trimmed:
  - egress.py: dropped EGRESS_IMAGE, EGRESS_DOCKERFILE,
    build_egress_image, egress_url. Kept EGRESS_PORT, CA paths,
    egress_container_name (still used by the renderer's network
    aliases).
  - git_gate.py: dropped GIT_GATE_IMAGE, GIT_GATE_DOCKERFILE,
    build_git_gate_image. Kept git_gate_host + GIT_GATE_PORT.
  - supervise.py: dropped SUPERVISE_IMAGE, SUPERVISE_DOCKERFILE,
    build_supervise_image, supervise_url.

- Deleted Dockerfile.{egress,git-gate,supervise}. The bundle's
  Dockerfile.sidecars is the only sidecar image now.

- test_compose.py: deleted TestPipelockAlwaysPresent,
  TestConditionalGitGate, TestConditionalEgress,
  TestConditionalSupervise, TestFullMatrix (legacy-shape only),
  TestSidecarBundleFlag (flag is gone). TestSidecarBundleShape
  drops its patch.dict wrapper. TestAgentAlwaysPresent's
  depends_on cases collapse to one.

- test_pipelock_apply.py: bringup container name uses
  sidecar_bundle_container_name(slug) to match the production
  target.

- README.md Architecture section rewritten to describe the
  agent + bundle pair.

Net: -626 lines.

Test status: 498 unit + 27 integration + 1 skipped (chunk-4
pending — superseded by this chunk's rewrite). Locally verified
end-to-end bottle launch produces exactly 2 containers
(claude-bottle-<slug> + claude-bottle-sidecars-<slug>).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -69,16 +69,22 @@ pieces of v1.
 
 ## Architecture
 
-A bottle is the agent container plus up to three per-protocol egress
-sidecars on a per-agent Docker `--internal` network. The agent has no
-default route off-box. All HTTP and HTTPS egress — from the agent
-*and* from cred-proxy when it dials an upstream — funnels through
-pipelock, where the egress allowlist, TLS interception, and
-request-body DLP scanner enforce the manifest before any byte leaves
-the host. The only egress that doesn't traverse pipelock is git-gate's
-SSH push/fetch to `bottle.git` upstreams — pipelock can't proxy SSH,
-so git-gate is its own L4-style egress path with gitleaks doing the
-pre-receive scan.
+A bottle is two containers per agent: an `agent` container, and a
+`sidecars` container that bundles pipelock + egress + git-gate +
+supervise behind a Python init supervisor (PRD 0024). They share a
+per-agent Docker `--internal` network; the agent has no default
+route off-box. All HTTP and HTTPS egress funnels through pipelock,
+where the egress allowlist, TLS interception, and request-body DLP
+scanner enforce the manifest before any byte leaves the host. The
+only egress that doesn't traverse pipelock is git-gate's SSH
+push/fetch to `bottle.git` upstreams — pipelock can't proxy SSH,
+so git-gate is its own L4-style egress path with gitleaks doing
+the pre-receive scan.
+
+The agent dials the bundle by the legacy short names (`pipelock`,
+`egress`, `git-gate`, `supervise`); the renderer registers those as
+docker-network aliases on the bundle so existing HTTPS_PROXY URLs
+and MCP endpoints resolve without an agent-side change.
 
 ```
                             host  ( ./cli.py )