refactor(sidecars): instantiate sidecar ABCs directly from any backend

The four sidecar prepare-time helpers (PipelockProxy, Egress, GitGate,
Supervise) had docker-flavored subclasses that existed only as
instantiation shims for ABCs that already had no abstract methods.
PipelockProxy.prepare() reached for class-level CA path constants
that were only defined on the docker subclass — so smolmachines had
to import DockerPipelockProxy to render pipelock yaml, reaching
across the backend boundary for what's actually a platform-neutral
operation.

This moves the universal in-container CA paths
(PIPELOCK_CA_CERT_IN_CONTAINER / PIPELOCK_CA_KEY_IN_CONTAINER) to
claude_bottle/pipelock.py, drops the class-attr indirection on the
ABC, and deletes the four empty docker subclasses. Both backends
now instantiate the ABCs directly; the docker-side modules keep
the docker-flavored helpers (image pin, container naming, host CA
mint) and re-export the moved pipelock constants for compat.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/docker/supervise.py

@@ -1,13 +1,13 @@
-"""DockerSupervise — Docker-flavored supervise config (PRD 0013).
-Inherits the platform-agnostic prepare step (queue dir +
-current-config staging) from `Supervise`. The supervise daemon
-runs inside the sidecar bundle (PRD 0024); this module just holds
-the container-name helper the renderer's network alias targets."""
+"""Docker-side supervise helpers: container naming for the legacy
+per-sidecar topology (kept so the bundle's docker-network alias
+resolves the old name to the bundle IP). The prepare-time
+queue-dir + current-config staging lives on the platform-neutral
+`Supervise` ABC — backends instantiate it directly. The
+supervise daemon's container lifecycle is owned by the sidecar
+bundle (PRD 0024)."""
 
 from __future__ import annotations
 
-from ...supervise import Supervise
-
 
 def supervise_container_name(slug: str) -> str:
     """The legacy per-sidecar container name. Kept as a function so
@@ -15,9 +15,3 @@ def supervise_container_name(slug: str) -> str:
     bundle — any code still referring to
     `claude-bottle-supervise-<slug>` resolves to the bundle's IP."""
     return f"claude-bottle-supervise-{slug}"
-
-
-class DockerSupervise(Supervise):
-    """Docker-flavored Supervise: inherits `.prepare()` from the base.
-    The supervise daemon's container lifecycle is owned by the
-    sidecar bundle (PRD 0024)."""