feat(smolmachines): provision_ca + provision_git + provision_supervise (PRD 0023 chunk 4d)

End-to-end provisioning parity with the docker backend. After this
chunk a smolmachines bottle has a working trust store, git-gate
gitconfig, and supervise MCP registration — same shape as docker,
dispatched via `smolvm machine cp` / `smolvm machine exec` instead
of `docker cp` / `docker exec`.

Adds three new provision modules:
- ca.py:        select egress vs pipelock CA (same logic as
                docker), machine cp + update-ca-certificates,
                log sha256 fingerprint.
- git.py:       copy host .git when --cwd was passed; render
                ~/.gitconfig with insteadOf URLs. URL prefix is
                `git://<bundle_ip>:9418/...` (no DNS in the
                TSI-allowlisted guest) vs docker's
                `git://git-gate/...`.
- supervise.py: `claude mcp add` via machine_exec; URL is
                `http://<bundle_ip>:9100/`. Failure is logged but
                non-fatal (matches docker).

Shared render: `render_git_gate_gitconfig` moves out of
backend/docker/provision/git.py into the platform-neutral
claude_bottle/git_gate.py (renamed to git_gate_render_gitconfig
for consistency with the existing git_gate_render_* helpers),
parameterized on a `gate_host` argument so both backends use the
same logic with different addresses.

Path/user fixups for the post-chunk-4c agent image (real
claude-bottle image, USER node, $HOME=/home/node):
- prompt.py default path moves from /root/... to
  /home/node/.claude-bottle-prompt.txt; chown + chmod after
  machine cp.
- skills.py default skills dir moves from /root/.claude/skills to
  /home/node/.claude/skills; chown -R per skill.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/smolmachines/backend.py

@@ -13,8 +13,11 @@ from . import prepare as _prepare
 from .bottle import SmolmachinesBottle
 from .bottle_cleanup_plan import SmolmachinesBottleCleanupPlan
 from .bottle_plan import SmolmachinesBottlePlan
+from .provision import ca as _ca
+from .provision import git as _git
 from .provision import prompt as _prompt
 from .provision import skills as _skills
+from .provision import supervise as _supervise
 
 
 class SmolmachinesBottleBackend(
@@ -37,6 +40,11 @@ class SmolmachinesBottleBackend(
         with _launch.launch(plan, provision=self.provision) as bottle:
             yield bottle
 
+    def provision_ca(
+        self, plan: SmolmachinesBottlePlan, target: str
+    ) -> None:
+        _ca.provision_ca(plan, target)
+
     def provision_prompt(
         self, plan: SmolmachinesBottlePlan, target: str
     ) -> str | None:
@@ -50,10 +58,12 @@ class SmolmachinesBottleBackend(
     def provision_git(
         self, plan: SmolmachinesBottlePlan, target: str
     ) -> None:
-        # Chunk 4 follow-on: needs the git-gate inner Plan (so the
-        # gitconfig insteadOf URL points at the gate's host) and
-        # the agent image must contain `git`. Stub for chunk 4a.
-        pass
+        _git.provision_git(plan, target)
+
+    def provision_supervise(
+        self, plan: SmolmachinesBottlePlan, target: str
+    ) -> None:
+        _supervise.provision_supervise(plan, target)
 
     def prepare_cleanup(self) -> SmolmachinesBottleCleanupPlan:
         return SmolmachinesBottleCleanupPlan()