feat(cred_proxy): wire DockerCredProxy through backend (PRD 0010)

- DockerBottleBackend instantiates DockerCredProxy alongside pipelock
  and git-gate; threads it through prepare and launch.
- DockerBottlePlan gains cred_proxy_plan; preflight rendering shows
  the declared kinds + TokenRefs and to_dict emits a cred_proxy
  array matching the routing table.
- prepare.py: when bottle.tokens has an anthropic entry, route the
  agent at the proxy via ANTHROPIC_BASE_URL, drop the agent-side
  CLAUDE_CODE_OAUTH_TOKEN forward (the token goes to the sidecar's
  environ instead, set a non-secret placeholder so claude-code's
  startup check passes), and default the telemetry-off env vars.
- launch.py: bring up the cred-proxy sidecar in ExitStack before the
  agent container so DNS resolution for `cred-proxy` succeeds on the
  agent's first call.
- backend/__init__.py: add provision_cred_proxy to the provision
  template (runs after provision_git so it can append to ~/.gitconfig).
- bottle_plan _view: env_names is derived from the forwarded_env dict,
  so the preflight reflects the PRD 0010 switch without ad-hoc
  branching on spec.forward_oauth_token.

claude_bottle/backend/docker/bottle_plan.py

@@ -11,6 +11,7 @@ import sys
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from ...cred_proxy import CredProxyPlan
 from ...git_gate import GitGatePlan
 from ...log import info
 from ...manifest import Agent, Bottle
@@ -51,6 +52,7 @@ class DockerBottlePlan(BottlePlan):
     prompt_file: Path
     proxy_plan: PipelockProxyPlan
     git_gate_plan: GitGatePlan
+    cred_proxy_plan: CredProxyPlan
     allowlist_summary: str
     use_runsc: bool
 
@@ -59,9 +61,13 @@ class DockerBottlePlan(BottlePlan):
         manifest = spec.manifest
         agent = manifest.agents[spec.agent_name]
         bottle = manifest.bottle_for(spec.agent_name)
-        env_names = list(bottle.env.keys())
-        if spec.forward_oauth_token:
-            env_names.append("CLAUDE_CODE_OAUTH_TOKEN")
+        # The agent sees the union of literal env names (rendered into
+        # --env-file) and forwarded env names (`-e NAME` with the value
+        # arriving via subprocess env). The forwarded set already
+        # reflects PRD 0010's switch — when cred-proxy holds the
+        # anthropic token, CLAUDE_CODE_OAUTH_TOKEN is absent and
+        # ANTHROPIC_BASE_URL is present.
+        env_names = sorted(set(bottle.env.keys()) | set(self.forwarded_env.keys()))
         return _PlanView(
             agent=agent,
             bottle=bottle,
@@ -100,6 +106,19 @@ class DockerBottlePlan(BottlePlan):
             info(f"  git gate      : {'; '.join(git_lines)}")
         else:
             info("  git remotes   : (none)")
+        if self.cred_proxy_plan.upstreams:
+            kinds: list[str] = []
+            seen: set[str] = set()
+            for u in self.cred_proxy_plan.upstreams:
+                key = u.kind if u.kind != "gitea" else f"gitea ({u.upstream})"
+                if key in seen:
+                    continue
+                seen.add(key)
+                kinds.append(key)
+            refs = sorted({u.token_ref for u in self.cred_proxy_plan.upstreams})
+            info(f"  cred-proxy    : {', '.join(kinds)}; tokens: {', '.join(refs)}")
+        else:
+            info("  cred-proxy    : (none)")
         info(f"  egress        : {self.allowlist_summary}")
         info("  tls intercept : pipelock (per-bottle ephemeral CA, generated at launch)")
         info(
@@ -132,6 +151,16 @@ class DockerBottlePlan(BottlePlan):
                 }
                 for u in self.git_gate_plan.upstreams
             ],
+            "cred_proxy": [
+                {
+                    "kind": u.kind,
+                    "path": u.path,
+                    "upstream": u.upstream,
+                    "auth_scheme": u.auth_scheme,
+                    "token_ref": u.token_ref,
+                }
+                for u in self.cred_proxy_plan.upstreams
+            ],
             "egress": {
                 "host_count": len(hosts),
                 "hosts": hosts,