chore: remove all pipelock references from tests, docs, and non-pipelock source

- Strip pipelock from all unit and integration test fixtures:
  proxy_plan fields removed from DockerBottlePlan/SmolmachinesBottlePlan
  constructors; pipelock-specific test classes deleted or renamed
- Update test_sidecar_init: remove test_pipelock_loses_egress_tokens,
  rename "pipelock" daemon fixtures to "git-gate" throughout
- Remove test_pipelock_binary_present_and_versioned from integration test
- Remove test_pipelock_answers_on_bundle_ip from smolmachines launch test
- Update _SANDBOX_BLOCK_MARKERS: remove "pipelock" marker (egress blocks)
- Dockerfile.sidecars: remove pipelock build stage and COPY; update layout
  comments and port table
- egress_entrypoint.sh: update comments now that egress is sole proxy
- Clean up pipelock references in comments/docstrings across backend,
  network, manifest, supervise, git_gate, yaml_subset, agent_provider,
  sidecar_bundle, sidecar_init, egress_addon_core modules

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/test_smolmachines_bundle_bringup.py

@@ -81,13 +81,9 @@ class TestBundleBringup(unittest.TestCase):
             subnet=subnet,
             gateway=gateway,
             bundle_ip=bundle_ip,
-            # Only run the pipelock daemon for this smoke — it's
-            # the lightest of the four and doesn't need bind
-            # mounts beyond what we'd skip without
-            # BOT_BOTTLE_SIDECAR_DAEMONS. (The init
-            # supervisor will exit if pipelock fails to find its
-            # yaml — that's expected here; we just need the
-            # container to land on the network at the right IP.)
+            # Empty daemons_csv → init exits "no daemons selected"
+            # immediately. We just need the container to land on
+            # the network at the right IP before it exits.
             daemons_csv="",  # empty → init exits "no daemons selected"
         )
         start_bundle(spec)