chore: remove all pipelock references from tests, docs, and non-pipelock source

- Strip pipelock from all unit and integration test fixtures:
  proxy_plan fields removed from DockerBottlePlan/SmolmachinesBottlePlan
  constructors; pipelock-specific test classes deleted or renamed
- Update test_sidecar_init: remove test_pipelock_loses_egress_tokens,
  rename "pipelock" daemon fixtures to "git-gate" throughout
- Remove test_pipelock_binary_present_and_versioned from integration test
- Remove test_pipelock_answers_on_bundle_ip from smolmachines launch test
- Update _SANDBOX_BLOCK_MARKERS: remove "pipelock" marker (egress blocks)
- Dockerfile.sidecars: remove pipelock build stage and COPY; update layout
  comments and port table
- egress_entrypoint.sh: update comments now that egress is sole proxy
- Clean up pipelock references in comments/docstrings across backend,
  network, manifest, supervise, git_gate, yaml_subset, agent_provider,
  sidecar_bundle, sidecar_init, egress_addon_core modules

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/test_sidecar_bundle_image.py

@@ -1,15 +1,15 @@
 """Integration: PRD 0024 chunk 1 — the sidecar bundle image builds
-and the four daemon binaries are present + executable inside it.
+and the daemon binaries are present + executable inside it.
 
 This test does NOT exercise the daemons running against real
-config (pipelock.yaml, routes.yaml, etc) — that lands in chunk 2
-when the renderer wires the bundle into compose. What we verify
-here is the chunk-1 contract:
+config (routes.yaml, etc) — that lands in chunk 2 when the
+renderer wires the bundle into compose. What we verify here is
+the chunk-1 contract:
 
   - Dockerfile.sidecars builds (multi-stage works, base layers
     pull, COPYs resolve).
-  - pipelock, gitleaks, mitmdump are at the documented paths and
-    answer `--version`.
+  - gitleaks, mitmdump are at the documented paths and answer
+    `--version`.
   - The Python init at /app/sidecar_init.py runs and prints the
     expected "no daemons selected" line when the supervisor is
     pointed at an empty daemon set.
@@ -74,11 +74,6 @@ class TestSidecarBundleImage(unittest.TestCase):
         )
         return proc.returncode, proc.stdout.decode("utf-8", errors="replace")
 
-    def test_pipelock_binary_present_and_versioned(self):
-        rc, out = self._run_in_image("/usr/local/bin/pipelock", "version")
-        self.assertEqual(0, rc, msg=out)
-        self.assertIn("pipelock version", out)
-
     def test_gitleaks_binary_present_and_versioned(self):
         rc, out = self._run_in_image("/usr/bin/gitleaks", "version")
         self.assertEqual(0, rc, msg=out)