refactor(backend): introduce BottleProvisioner ABC + DockerBottleProvisioner

Lift the file-copying-into-the-running-container step out of
DockerBottleBackend._provision_container into its own class. The
backend now holds a DockerBottleProvisioner instance and delegates
the post-launch provisioning to it.

  - BottleProvisioner (abstract) in backend/__init__.py with a
    `provision(plan, target) -> str | None` method.
  - DockerBottleProvisioner (concrete) in backend/docker/provisioner.py
    inheriting from the base, narrowing plan to DockerBottlePlan via
    isinstance, and carrying the prompt/skills/SSH/.git copy logic
    unchanged.
  - DockerBottleBackend keeps a class-level DockerBottleProvisioner()
    and calls self._provisioner.provision(plan, container) from launch.
    _provision_container method removed.

No behavior change.

claude_bottle/backend/docker/backend.py

@@ -28,6 +28,7 @@ from . import util as docker_mod
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
+from .provisioner import DockerBottleProvisioner
 
 
 # Where the repo root lives, for `docker build` context. Computed once.
@@ -39,6 +40,7 @@ class DockerBottleBackend(BottleBackend):
     (default)."""
 
     name = "docker"
+    _provisioner: DockerBottleProvisioner = DockerBottleProvisioner()
 
     def prepare(self, spec: BottleSpec, *, stage_dir: Path) -> DockerBottlePlan:
         """Resolve names, validate, write scratch files. No Docker
@@ -185,7 +187,7 @@ class DockerBottleBackend(BottleBackend):
             container = self._run_agent_container(plan, state["internal_network"])
             state["container"] = container
 
-            prompt_path = self._provision_container(plan, container)
+            prompt_path = self._provisioner.provision(plan, container)
 
             bottle = DockerBottle(container, teardown, prompt_path)
             yield bottle
@@ -258,60 +260,6 @@ class DockerBottleBackend(BottleBackend):
             docker_args[name_idx] = container
             info(f"name conflict; retrying as {container}")
 
-    def _provision_container(self, plan: DockerBottlePlan, container: str) -> str | None:
-        """Copy prompt, skills, ssh keys, and (optionally) .git into the
-        running container. Returns the in-container prompt path if a
-        prompt was provisioned, else None — the Bottle handle uses it
-        to decide whether to add --append-system-prompt-file to
-        claude's argv."""
-        container_home = os.environ.get("CLAUDE_BOTTLE_CONTAINER_HOME", "/home/node")
-        in_container_prompt_path = f"{container_home}/.claude-bottle-prompt.txt"
-
-        subprocess.run(
-            ["docker", "cp", str(plan.prompt_file), f"{container}:{in_container_prompt_path}"],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-        # `docker cp` preserves host UID; re-own/mode as root so node
-        # can read its own mode-600 prompt regardless of host UID.
-        subprocess.run(
-            ["docker", "exec", "-u", "0", container, "chown", "node:node", in_container_prompt_path],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-        subprocess.run(
-            ["docker", "exec", "-u", "0", container, "chmod", "600", in_container_prompt_path],
-            stdout=subprocess.DEVNULL,
-            check=True,
-        )
-
-        agent = plan.spec.manifest.agents[plan.spec.agent_name]
-        if agent.skills:
-            skills_mod.skills_copy_into(container, list(agent.skills))
-
-        bottle = plan.spec.manifest.bottle_for(plan.spec.agent_name)
-        if bottle.ssh:
-            proxy_host_port = pipelock.pipelock_proxy_host_port(plan.slug)
-            ssh_mod.ssh_setup(container, plan.stage_dir, proxy_host_port, bottle.ssh)
-
-        if plan.spec.copy_cwd and Path(plan.spec.user_cwd, ".git").is_dir():
-            info(f"copying {plan.spec.user_cwd}/.git -> {container}:/home/node/workspace/.git")
-            subprocess.run(
-                ["docker", "cp", f"{plan.spec.user_cwd}/.git", f"{container}:/home/node/workspace/.git"],
-                stdout=subprocess.DEVNULL,
-                check=True,
-            )
-            subprocess.run(
-                [
-                    "docker", "exec", "-u", "0", container,
-                    "chown", "-R", "node:node", "/home/node/workspace/.git",
-                ],
-                stdout=subprocess.DEVNULL,
-                check=True,
-            )
-
-        return in_container_prompt_path if agent.prompt else None
-
     # --- Cleanup ---
 
     def prepare_cleanup(self) -> DockerBottleCleanupPlan: