refactor(docker): drop legacy per-sidecar container_name functions

Same line of cleanup as the supervise rename: the per-sidecar
container names (`claude-bottle-pipelock-<slug>`,
`claude-bottle-egress-<slug>`, `claude-bottle-git-gate-<slug>`)
were docker-network aliases pointing at the bundle, kept so legacy
URLs would keep resolving. Replaces them with short hostnames
(`pipelock`, `egress`, `git-gate`) matching the existing
`EGRESS_HOSTNAME` pattern, and inlines the bundle-loopback URL
(`http://127.0.0.1:8888`) for the in-bundle egress→pipelock hop —
matching what smolmachines already does.

Drops the three `*_container_name` functions, `pipelock_proxy_url`,
and `git_gate_host`. Their callers move to the new constants:
- `PIPELOCK_HOSTNAME = "pipelock"` (claude_bottle/pipelock.py)
- `GIT_GATE_HOSTNAME = "git-gate"` (claude_bottle/git_gate.py)
- `BUNDLE_LOCAL_PIPELOCK_URL` (backend/docker/pipelock.py)

The agent's HTTP_PROXY now reads `http://pipelock:8888` (vs the
old `http://claude-bottle-pipelock-<slug>:8888`); the gitconfig
insteadOf rewrites become `git://git-gate/<repo>.git`. The prepare-
time orphan probe is collapsed onto the bundle container name
(`claude-bottle-sidecars-<slug>`) instead of the four legacy
per-sidecar names that no backend creates anymore.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/pipelock.py

@@ -55,6 +55,12 @@ PIPELOCK_CA_CERT_IN_CONTAINER = "/etc/pipelock-ca.pem"
 PIPELOCK_CA_KEY_IN_CONTAINER = "/etc/pipelock-ca-key.pem"
 
 
+# Short network alias for pipelock inside the sidecar bundle. The
+# agent's HTTP_PROXY (when no egress is declared) and any in-bundle
+# consumer's URL both reference this name.
+PIPELOCK_HOSTNAME = "pipelock"
+
+
 # --- Allowlist resolution --------------------------------------------------
 
 
@@ -329,10 +335,10 @@ class PipelockProxy:
 
         `slug` is the agent-derived identifier (lowercased,
         hyphen-normalized) used as the suffix in every per-agent
-        resource name — the agent container, the pipelock container
-        (`claude-bottle-pipelock-<slug>`), the internal/egress
-        networks. It's stored on the returned plan so the backend's
-        launch step can derive the sidecar's container name.
+        resource name — the agent container, the sidecar bundle
+        container, the internal/egress networks. It's stored on the
+        returned plan so the backend's launch step can derive those
+        names.
 
         The CA paths the YAML references are the module-level
         in-container constants. The host-side counterparts are