refactor(manifest): drop bottle.egress field, egress_proxy is the only allowlist

Goal: one allowlist surface (egress_proxy.routes), no second
free-form `egress:` knob. Anything that used to live there now
goes in `egress_proxy.routes` as a bare-pass entry
(`- host: <name>`).

Removed:
  - `BottleEgress` dataclass + DLP_ACTIONS constant + bottle.egress
    field on `Bottle`.
  - `pipelock_bottle_allowlist` helper.
  - `pipelock_allowlist_summary` helper (the compact preflight
    summary stopped using it after PR #31).
  - `allowlist_summary` field on `DockerBottlePlan`.
  - `bottle.egress.allowlist` folding in
    `egress_proxy_routes_for_bottle` — only DEFAULT_ALLOWLIST
    auto-folds now.
  - The two-branch logic in `pipelock_effective_allowlist`
    (egress-proxy-present vs not) — pipelock now just mirrors
    `egress_proxy_routes_for_bottle` unconditionally.

Hard-coded:
  - `request_body_scanning.action = "block"` in
    `pipelock_build_config` (was driven by
    `bottle.egress.dlp_action`). The previous default was already
    "block" — the knob to switch to "warn" was a foot-gun in a
    sandboxed agent context, so it's gone.

Tests:
  - `test_pipelock_allowlist.py` rewritten to assert the
    mirrored-from-egress-proxy semantics directly.
  - `test_manifest_md_load.py`, `test_pipelock_yaml.py`,
    `test_egress_proxy.py` fixtures migrated to put hosts in
    `egress_proxy.routes` instead of `egress.allowlist`.

Local bottle migrated too: `~/.claude-bottle/bottles/dev.md`
loses the `egress: { allowlist: [example.com] }` block, picks up
a bare-pass `- host: example.com` route.

409 unit + integration tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/docker/bottle_plan.py

@@ -49,7 +49,6 @@ class DockerBottlePlan(BottlePlan):
     # None when bottle.supervise is False. PRD 0013 supervise sidecar
     # is opt-in via the manifest's bottle.supervise field.
     supervise_plan: SupervisePlan | None
-    allowlist_summary: str
     use_runsc: bool
 
     def print(self, *, remote_control: bool) -> None:

claude_bottle/backend/docker/prepare.py

@@ -14,7 +14,6 @@ import os
 from datetime import datetime, timezone
 from pathlib import Path
 
-from ... import pipelock
 from ...env import ResolvedEnv, resolve_env
 from ...log import die
 from .. import BottleSpec
@@ -192,7 +191,6 @@ def resolve_plan(
     _write_env_file(resolved, env_file)
     prompt_file.write_text(agent.prompt)
 
-    allowlist_summary = pipelock.pipelock_allowlist_summary(bottle)
     use_runsc = docker_mod.runsc_available()
 
     return DockerBottlePlan(
@@ -212,7 +210,6 @@ def resolve_plan(
         git_gate_plan=git_gate_plan,
         egress_proxy_plan=egress_proxy_plan,
         supervise_plan=supervise_plan,
-        allowlist_summary=allowlist_summary,
         use_runsc=use_runsc,
     )