refactor(sidecars): instantiate sidecar ABCs directly from any backend

The four sidecar prepare-time helpers (PipelockProxy, Egress, GitGate,
Supervise) had docker-flavored subclasses that existed only as
instantiation shims for ABCs that already had no abstract methods.
PipelockProxy.prepare() reached for class-level CA path constants
that were only defined on the docker subclass — so smolmachines had
to import DockerPipelockProxy to render pipelock yaml, reaching
across the backend boundary for what's actually a platform-neutral
operation.

This moves the universal in-container CA paths
(PIPELOCK_CA_CERT_IN_CONTAINER / PIPELOCK_CA_KEY_IN_CONTAINER) to
claude_bottle/pipelock.py, drops the class-attr indirection on the
ABC, and deletes the four empty docker subclasses. Both backends
now instantiate the ABCs directly; the docker-side modules keep
the docker-flavored helpers (image pin, container naming, host CA
mint) and re-export the moved pipelock constants for compat.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/docker/egress.py

@@ -1,11 +1,11 @@
-"""DockerEgress — the Docker-specific lifecycle for the
-per-bottle egress sidecar (PRD 0017). Inherits the platform-
-agnostic prepare step (route lift + routes.yaml render + token-env
-map derivation) from `Egress`.
+"""Docker-side egress helpers: port pin, in-container CA paths,
+container naming, and the host-side mitmproxy CA mint. The
+prepare-time routes-yaml rendering itself lives on the
+platform-neutral `Egress` ABC — backends instantiate it directly.
 
-Chunks 1+2 of the PRD: the lifecycle is implemented and wired into
-launch.py — cred-proxy is gone. Chunk 3 retargets the cred-proxy-
-block remediation flow (PRD 0014)."""
+The per-container `.start()` / `.stop()` lifecycle was removed in
+PRD 0024 chunk 3; the sidecar bundle (PRD 0024) runs egress
+under its python init supervisor."""
 
 from __future__ import annotations
 
@@ -13,7 +13,6 @@ import os
 import subprocess
 from pathlib import Path
 
-from ...egress import Egress
 from ...log import die
 
 
@@ -130,9 +129,3 @@ def egress_tls_init(stage_dir: Path) -> tuple[Path, Path]:
     mitm.write_bytes(cert_path.read_bytes() + key_path.read_bytes())
     mitm.chmod(0o644)
     return (mitm, cert_path)
-
-
-class DockerEgress(Egress):
-    """Docker-flavored Egress: inherits `.prepare()` from the base.
-    Container lifecycle is owned by compose; per-container
-    `.start()` / `.stop()` were removed in PRD 0024 chunk 3."""