chore: remove all pipelock references from tests, docs, and non-pipelock source

- Strip pipelock from all unit and integration test fixtures:
  proxy_plan fields removed from DockerBottlePlan/SmolmachinesBottlePlan
  constructors; pipelock-specific test classes deleted or renamed
- Update test_sidecar_init: remove test_pipelock_loses_egress_tokens,
  rename "pipelock" daemon fixtures to "git-gate" throughout
- Remove test_pipelock_binary_present_and_versioned from integration test
- Remove test_pipelock_answers_on_bundle_ip from smolmachines launch test
- Update _SANDBOX_BLOCK_MARKERS: remove "pipelock" marker (egress blocks)
- Dockerfile.sidecars: remove pipelock build stage and COPY; update layout
  comments and port table
- egress_entrypoint.sh: update comments now that egress is sole proxy
- Clean up pipelock references in comments/docstrings across backend,
  network, manifest, supervise, git_gate, yaml_subset, agent_provider,
  sidecar_bundle, sidecar_init, egress_addon_core modules

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/test_smolmachines_sidecar_bundle.py

@@ -134,34 +134,35 @@ class TestStartBundle(unittest.TestCase):
 
     def test_daemons_env_passed_in(self):
         with self._patch_run() as m:
-            start_bundle(_spec(daemons_csv="egress,pipelock,supervise"))
+            start_bundle(_spec(daemons_csv="egress,supervise"))
         argv = m.call_args.args[0]
         self.assertIn("-e", argv)
         self.assertIn(
-            "BOT_BOTTLE_SIDECAR_DAEMONS=egress,pipelock,supervise",
+            "BOT_BOTTLE_SIDECAR_DAEMONS=egress,supervise",
             argv,
         )
 
     def test_environment_entries_pass_through(self):
         with self._patch_run() as m:
             start_bundle(_spec(environment=(
-                "EGRESS_UPSTREAM_PROXY=http://...",
                 "SUPERVISE_BOTTLE_SLUG=demo-abc12",
                 "EGRESS_TOKEN_0",  # bare-name → host env inherit
             )))
         argv = m.call_args.args[0]
-        self.assertIn("EGRESS_UPSTREAM_PROXY=http://...", argv)
         self.assertIn("SUPERVISE_BOTTLE_SLUG=demo-abc12", argv)
         self.assertIn("EGRESS_TOKEN_0", argv)
 
     def test_volumes_render_with_ro_flag(self):
         with self._patch_run() as m:
             start_bundle(_spec(volumes=(
-                ("/host/pipelock.yaml", "/etc/pipelock.yaml", True),
+                ("/host/egress-ca.pem", "/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem", True),
                 ("/host/queue", "/run/supervise/queue", False),
             )))
         argv = m.call_args.args[0]
-        self.assertIn("/host/pipelock.yaml:/etc/pipelock.yaml:ro", argv)
+        self.assertIn(
+            "/host/egress-ca.pem:/home/mitmproxy/.mitmproxy/mitmproxy-ca.pem:ro",
+            argv,
+        )
         self.assertIn("/host/queue:/run/supervise/queue", argv)
 
     def test_failure_dies(self):