feat(compose): emit bundle shape behind feature flag (PRD 0024 chunk 2)

The docker backend's compose renderer now emits a single
`sidecars` service in place of the four per-sidecar services
when CLAUDE_BOTTLE_SIDECAR_BUNDLE is truthy. Default (unset/0/
false) keeps the legacy five-service shape so existing operators
don't have to migrate atomically; chunks 4-5 flip the default
and delete the flag.

New module claude_bottle/backend/docker/sidecar_bundle.py owns
the bundle image constant (CLAUDE_BOTTLE_SIDECAR_IMAGE env var
override + claude-bottle-sidecars:latest default), the
Dockerfile reference, the container-name helper, and the
flag-parser.

The bundle service:
- joins both internal + egress networks with aliases for every
  legacy shortname + per-slug long form so the agent's
  HTTPS_PROXY URL (which dials `egress` or
  `claude-bottle-pipelock-<slug>`) keeps resolving with no
  agent-side change
- carries CLAUDE_BOTTLE_SIDECAR_DAEMONS=<csv> for the init
  supervisor to narrow which daemons to start
- carries the union of the four prior services' daemon-private
  env vars (EGRESS_UPSTREAM_PROXY, SUPERVISE_*, token env names)
- does NOT carry HTTPS_PROXY/HTTP_PROXY/NO_PROXY — those would
  route git-gate's git fetches through pipelock by mistake
- union'd bind-mounts at the same in-container paths as before

HTTPS_PROXY scoping moved into egress_entrypoint.sh so only
mitmdump's subprocess sees it. In the legacy four-sidecar shape
the env vars also lived in the egress service's compose env;
the shell script's export is additionally defensive.

Tests:
- All 44 existing TestCompose cases pass unchanged (flag off →
  legacy shape).
- 20 new TestSidecarBundleShape cases assert on the bundle's
  services / aliases / env / volumes / depends_on under the
  flag.
- 8 new TestSidecarBundleFlag cases lock down the env-var
  parser (unset / 0 / false / no / off → disabled; everything
  else → enabled).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_entrypoint.sh

@@ -32,4 +32,18 @@ if [ -n "$EGRESS_UPSTREAM_CA" ] && [ -f "$EGRESS_UPSTREAM_CA" ]; then
   TRUST_FLAG="--set ssl_verify_upstream_trusted_ca=$COMBINED"
 fi
 
+# Scope the proxy env to this process tree only. In the bundle
+# image (PRD 0024) the four daemons share one container — setting
+# HTTPS_PROXY at the container level would route git-gate's git
+# pushes through pipelock, which is wrong (pipelock doesn't proxy
+# SSH and would block public git repos). Setting them here means
+# only mitmdump's subprocess inherits them. In the legacy
+# four-sidecar setup these env vars are also set in compose; here
+# they're additionally defensive.
+if [ -n "$EGRESS_UPSTREAM_PROXY" ]; then
+  export HTTPS_PROXY="$EGRESS_UPSTREAM_PROXY"
+  export HTTP_PROXY="$EGRESS_UPSTREAM_PROXY"
+  export NO_PROXY="localhost,127.0.0.1"
+fi
+
 exec mitmdump $MODE $TRUST_FLAG -s /app/egress_addon.py