feat(supervise): show the bottle's human slug, not its opaque id

Consolidated proposals are keyed by the orchestrator-assigned bottle_id,
so the supervise TUI was rendering a hex id (e.g. 3601cbe883c2786d) as
the bottle name — and the resume hint printed `./cli.py resume <id>`,
which resume can't take (it wants the human identity/slug).

`supervise_pending` now tags each dict with `bottle_label` — the human
slug resolved from registry metadata, falling back to the id when the
bottle is gone. `QueuedProposal` carries the label; every display site
(list rows, detail view, status lines, resume hint) shows it, while
approve/reject still key on `proposal.bottle_slug` (the id).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

tests/unit/test_orchestrator_service.py

@@ -226,6 +226,21 @@ class TestOrchestratorSupervise(unittest.TestCase):
         self.assertEqual(STATUS_APPROVED, read_response("demo", pid).status)
         self.assertEqual([], self.orch.supervise_pending())
 
+    def test_pending_carries_human_label(self) -> None:
+        # The proposal is keyed by bottle_id, but pending dicts also expose the
+        # bottle's human slug so the operator sees a name, not a hex id.
+        bottle_id = self._register("codex-dev-a1b2c", "routes: []\n")
+        self._queue(bottle_id, "routes:\n  - host: google.com\n")
+        pending = self.orch.supervise_pending()
+        self.assertEqual(bottle_id, pending[0]["bottle_slug"])
+        self.assertEqual("codex-dev-a1b2c", pending[0]["bottle_label"])
+
+    def test_pending_label_falls_back_to_slug_when_bottle_gone(self) -> None:
+        # No registry record (torn down): label is the id, never empty.
+        self._queue("ghost-id", "routes:\n  - host: google.com\n")
+        pending = self.orch.supervise_pending()
+        self.assertEqual("ghost-id", pending[0]["bottle_label"])
+
     def test_approve_by_bottle_id_applies_policy(self) -> None:
         # Consolidated reality: the supervise server keys each proposal by the
         # orchestrator-assigned bottle_id, not the human slug. Approval must