feat(egress-proxy): cutover from cred-proxy (PRD 0017 chunk 2)

Hard cutover. cred-proxy is deleted; egress-proxy is now the agent's
HTTP_PROXY (when routes are declared) with pipelock on its outbound
leg. Two per-bottle CAs are minted: egress-proxy's (agent trust
store) and pipelock's (egress-proxy's outbound trust store).

Manifest:
  - `bottle.cred_proxy` → hard error with a migration recipe.
  - `bottle.egress_proxy` is the new shape (PRD 0017 chunk 1).
  - CredProxy* types + role validators removed.

Wiring:
  - launch.py: `egress_proxy_tls_init` mints the egress-proxy CA
    (cert+key concat for mitmproxy + cert-only for agent trust);
    `DockerEgressProxy.start` docker-cps both CAs in, sets
    `HTTPS_PROXY=pipelock` + `EGRESS_PROXY_UPSTREAM_CA` so mitmdump
    trusts pipelock's MITM. Agent's HTTP_PROXY points at
    egress-proxy when routes exist, else falls back to pipelock
    (no-routes bottles unchanged).
  - prepare.py / backend.py: `cred_proxy` arg → `egress_proxy`;
    sidecar-orphan probe + plan field + dashboard view all
    renamed.
  - provision_ca: selects the egress-proxy CA when present, else
    pipelock's (filename renamed to claude-bottle-mitm-ca.crt).
  - bottle.provision: cred-proxy dotfile rewrites (~/.npmrc,
    ~/.gitconfig insteadOf, tea config) are gone — HTTP_PROXY
    catches everything respecting it.

Pipelock helpers:
  - `pipelock_token_hosts` → `pipelock_route_hosts` (now reading
    egress_proxy.routes).
  - cred-proxy hostname auto-allow → egress-proxy hostname
    auto-allow.
  - Anthropic seed-phrase workaround now triggers when an
    egress_proxy route targets api.anthropic.com (was based on the
    cred-proxy `anthropic-base-url` role).

Dockerfile.egress-proxy:
  - Entrypoint conditionally passes
    `--set ssl_verify_upstream_trusted_ca=$EGRESS_PROXY_UPSTREAM_CA`
    (via the `${VAR:+...}` shell expansion) so standalone runs without
    a mounted pipelock CA still boot.
  - mkdirs `/home/mitmproxy/.mitmproxy` ahead of `docker cp`.

Deleted: claude_bottle/{cred_proxy,cred_proxy_server}.py,
backend/docker/{cred_proxy,provision/cred_proxy}.py,
Dockerfile.cred-proxy, plus the corresponding unit + integration
tests. backend/docker/cred_proxy_apply.py stays as a stub for
chunk 3 to rewrite (its container-name + routes-path constants
are inlined so it survives without the deleted module).

Test changes:
  - test_pipelock_allowlist rewritten against egress-proxy routes
    + the new `pipelock_route_hosts`.
  - test_manifest_md_load + test_pipelock_yaml + test_yaml_subset
    fixtures migrated to the `egress_proxy: { routes: [...] }`
    shape.
  - test_supervise_sidecar's round-trip test switched from
    `dashboard.approve` to `dashboard.reject`: the approval-apply
    path on cred-proxy-block proposals hits a deleted sidecar in
    chunk 2's transitional state. Chunk 3 restores the approval
    test once the remediation flow is retargeted at egress-proxy.

376 tests pass (was 427; net delta is removed cred-proxy tests).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_proxy.py

@@ -16,9 +16,10 @@ dataclass (`EgressProxyPlan`), and the resolved per-route shape
 specific and lives on concrete subclasses (see
 `claude_bottle/backend/docker/egress_proxy.py`).
 
-Chunk 1 of the PRD: this module + the mitmproxy addon + the Docker
-lifecycle land alongside the existing cred-proxy code. Chunk 2 wires
-the agent's `HTTP_PROXY` over to egress-proxy and removes cred-proxy.
+Chunks 1+2 of the PRD: this module + the mitmproxy addon + the Docker
+lifecycle are wired into the agent's `HTTP_PROXY` path; cred-proxy
+has been removed. Chunk 3 retargets the cred-proxy-block remediation
+flow (PRD 0014) at egress-proxy and renames the MCP tool.
 """
 
 from __future__ import annotations
@@ -76,7 +77,7 @@ class EgressProxyPlan:
 
     The slug + routes_path + routes + token_env_map fields are
     filled at prepare time (host-side, side-effect-free on docker).
-    The network + pipelock fields are populated by the backend's
+    The network + CA + pipelock fields are populated by the backend's
     launch step via `dataclasses.replace` once those resources
     exist. Empty defaults are sentinels meaning "not yet set";
     `.start` validates that they are populated.
@@ -87,6 +88,22 @@ class EgressProxyPlan:
     under `token_env`. The plan itself never holds token values —
     secrets never land in a dataclass that might be logged.
 
+    `mitmproxy_ca_host_path` is the host path of the per-bottle
+    egress-proxy CA (single PEM with cert+key concatenated) minted
+    by `egress_proxy_tls_init`. `.start` docker-cps it into the
+    sidecar at `~/.mitmproxy/mitmproxy-ca.pem` — mitmproxy reads
+    that file at boot to mint per-host leaf certs.
+
+    `mitmproxy_ca_cert_only_host_path` is the cert-only PEM (no
+    key) for installing into the agent's trust store via
+    `provision_ca`. Separate file rather than re-parsing the
+    concat so secrets and trust artefacts stay on distinct paths.
+
+    `pipelock_ca_host_path` is the host path of the pipelock CA
+    (cert only). `.start` docker-cps it into the sidecar so the
+    proxy's outbound HTTPS client trusts pipelock's MITM on the
+    egress-proxy → upstream leg.
+
     `pipelock_proxy_url` is the URL egress-proxy sets as `HTTPS_PROXY`
     in its environ so outbound HTTPS traverses pipelock — keeping
     pipelock's hostname allowlist + DLP body scanner on the
@@ -99,6 +116,9 @@ class EgressProxyPlan:
     token_env_map: dict[str, str]
     internal_network: str = ""
     egress_network: str = ""
+    mitmproxy_ca_host_path: Path = Path()
+    mitmproxy_ca_cert_only_host_path: Path = Path()
+    pipelock_ca_host_path: Path = Path()
     pipelock_proxy_url: str = ""