refactor(sidecars): instantiate sidecar ABCs directly from any backend

The four sidecar prepare-time helpers (PipelockProxy, Egress, GitGate,
Supervise) had docker-flavored subclasses that existed only as
instantiation shims for ABCs that already had no abstract methods.
PipelockProxy.prepare() reached for class-level CA path constants
that were only defined on the docker subclass — so smolmachines had
to import DockerPipelockProxy to render pipelock yaml, reaching
across the backend boundary for what's actually a platform-neutral
operation.

This moves the universal in-container CA paths
(PIPELOCK_CA_CERT_IN_CONTAINER / PIPELOCK_CA_KEY_IN_CONTAINER) to
claude_bottle/pipelock.py, drops the class-attr indirection on the
ABC, and deletes the four empty docker subclasses. Both backends
now instantiate the ABCs directly; the docker-side modules keep
the docker-flavored helpers (image pin, container naming, host CA
mint) and re-export the moved pipelock constants for compat.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/docker/git_gate.py

@@ -1,13 +1,12 @@
-"""DockerGitGate — Docker-flavored git-gate config (PRD 0008).
-Inherits the platform-agnostic prepare step (upstream lift +
-entrypoint/hook render) from `GitGate`. The git-gate daemon runs
-inside the sidecar bundle (PRD 0024); this module just holds the
-in-container paths the renderer's bind-mounts target."""
+"""Docker-side git-gate helpers: in-container paths the renderer's
+bind-mounts target, port pin, and container naming. The
+prepare-time entrypoint/hook render lives on the platform-neutral
+`GitGate` ABC — backends instantiate it directly. The git-gate
+daemon's container lifecycle is owned by the sidecar bundle
+(PRD 0024)."""
 
 from __future__ import annotations
 
-from ...git_gate import GitGate
-
 
 GIT_GATE_ENTRYPOINT_IN_CONTAINER = "/git-gate-entrypoint.sh"
 GIT_GATE_HOOK_IN_CONTAINER = "/etc/git-gate/pre-receive"
@@ -31,9 +30,3 @@ def git_gate_host(slug: str) -> str:
     the bundle's network alias to the bundle container, where the
     git-gate daemon listens on GIT_GATE_PORT."""
     return git_gate_container_name(slug)
-
-
-class DockerGitGate(GitGate):
-    """Docker-flavored GitGate: inherits `.prepare()` from the base.
-    The git-gate daemon's container lifecycle is owned by the
-    sidecar bundle (PRD 0024)."""