refactor: move agent Dockerfiles into their contrib directories

Dockerfile.claude and Dockerfile.codex move from the repo root into
bot_bottle/contrib/claude/Dockerfile and bot_bottle/contrib/codex/Dockerfile
respectively, so all per-provider assets live alongside the provider code.

Closes #215

bot_bottle/backend/docker/capability_apply.py

@@ -126,11 +126,10 @@ def apply_capability_change(slug: str, new_dockerfile: str) -> tuple[str, str]:
 
 
 def _repo_dockerfile_path() -> Path:
-    """Path to the repo's Claude Dockerfile (one dir above this module's
-    package root). Resolved at call time so the path is correct
-    regardless of where this module is imported from."""
-    # bot_bottle/backend/docker/capability_apply.py -> repo root
-    return Path(__file__).resolve().parent.parent.parent.parent / "Dockerfile.claude"
+    """Path to the Claude provider Dockerfile. Resolved at call time so
+    the path is correct regardless of where this module is imported from."""
+    # bot_bottle/backend/docker/ -> bot_bottle/ -> contrib/claude/Dockerfile
+    return Path(__file__).resolve().parent.parent.parent / "contrib" / "claude" / "Dockerfile"
 
 
 def snapshot_transcript(slug: str) -> None:

bot_bottle/backend/docker/prepare.py

@@ -209,17 +209,16 @@ def resolve_plan(
 
     supervise_plan = None
     if bottle.supervise:
-        # Current Dockerfile for the agent image. Read from the repo
-        # root; for `--cwd` derived images the base Dockerfile is what
-        # the agent should propose changes against (the derived layer
-        # is just a workspace copy).
+        # Current Dockerfile for the agent image. For `--cwd` derived
+        # images the base Dockerfile is what the agent should propose
+        # changes against (the derived layer is just a workspace copy).
         # (routes.yaml used to land here too but PRD 0017 chunk 3
         # moved it behind the `list-egress-routes` MCP tool so the
         # agent gets live state rather than a launch-time snapshot.)
         supervise_dockerfile_path = (
             Path(dockerfile_path)
             if dockerfile_path
-            else Path(__file__).resolve().parent.parent.parent.parent / "Dockerfile.claude"
+            else Path(__file__).resolve().parent.parent.parent / "contrib" / "claude" / "Dockerfile"
         )
         dockerfile_content = (
             supervise_dockerfile_path.read_text(encoding="utf-8")

bot_bottle/contrib/claude/agent_provider.py

@@ -28,8 +28,6 @@ if TYPE_CHECKING:
     from ...backend import Bottle, BottlePlan
 
 
-_REPO_ROOT = Path(__file__).resolve().parents[3]
-
 _SUPERVISE_MCP_NAME = "supervise"
 
 
@@ -44,7 +42,7 @@ _RUNTIME = AgentProviderRuntime(
     template="claude",
     command="claude",
     image="bot-bottle-claude:latest",
-    dockerfile=str(_REPO_ROOT / "Dockerfile.claude"),
+    dockerfile=str(Path(__file__).resolve().parent / "Dockerfile"),
     prompt_mode="append_file",
     bypass_args=("--dangerously-skip-permissions",),
     resume_args=("--continue",),

bot_bottle/contrib/codex/agent_provider.py

@@ -32,8 +32,6 @@ if TYPE_CHECKING:
     from ...backend import Bottle, BottlePlan
 
 
-_REPO_ROOT = Path(__file__).resolve().parents[3]
-
 _SUPERVISE_MCP_NAME = "supervise"
 
 
@@ -52,7 +50,7 @@ _RUNTIME = AgentProviderRuntime(
     template="codex",
     command="codex",
     image="bot-bottle-codex:latest",
-    dockerfile=str(_REPO_ROOT / "Dockerfile.codex"),
+    dockerfile=str(Path(__file__).resolve().parent / "Dockerfile"),
     prompt_mode="read_prompt_file",
     bypass_args=("--dangerously-bypass-approvals-and-sandbox",),
     resume_args=("resume", "--last"),

scripts/demo-setup.sh

@@ -35,5 +35,5 @@ chmod 600 "$fake_key_dir/fake-key"
 
 # Build the image graph quietly so the recorded run shows only the
 # bottle launch and the four `!` probes, not BuildKit progress.
-docker build -q -f Dockerfile.claude -t bot-bottle-claude:latest . >/dev/null 2>&1 || true
+docker build -q -f bot_bottle/contrib/claude/Dockerfile -t bot-bottle-claude:latest . >/dev/null 2>&1 || true
 docker build -q -f Dockerfile.git-gate -t bot-bottle-git-gate:latest . >/dev/null 2>&1 || true