refactor(contrib): inline provision steps per-provider, drop shared apply module

Each AgentProvider now owns its skills / prompt / provision /
supervise_mcp end-to-end. The base ABC declares all four as
abstract; ClaudeAgentProvider and CodexAgentProvider each carry
their own copy loop.

Per PR review feedback (review #128): the shared
_provision_apply.py abstraction was weak — Claude and Codex
harnesses already diverge (codex's dummy-auth + login-status
verify has no claude analogue) and forcing both onto one helper
just postpones the split. Duplication is intentional.

Deletes bot_bottle/_provision_apply.py and consolidates testing
under tests/unit/test_contrib_{claude,codex}_provider.py (one
file per provider, covering all four methods).

docs/prds/0050-agent-provider-contrib.md

@@ -370,12 +370,15 @@ Each chunk is one commit on the PR; the PR ships as one cut.
    symmetric with `claude mcp add` (no `--scope user`; Codex writes
    `~/.codex/config.toml` by default). Failure logs a warning; the
    bottle still works without the entry.
-2. **Default methods on `AgentProvider`.** The base ABC's
-   `provision_skills` / `provision_prompt` / `provision` delegate
-   to a small `bot_bottle/_provision_apply.py` helper. Concrete
-   subclasses don't override the defaults today; the helper exists
-   so a future provider that legitimately needs a different layout
-   can stay declarative.
+2. **Each provider owns its apply steps end-to-end.** The base
+   ABC declares `provision_skills` / `provision_prompt` /
+   `provision` as abstract; each concrete provider implements its
+   own copy loop. No shared `_provision_apply.py`. The apply
+   sequences look similar today, but Claude and Codex harnesses
+   diverge over time (codex already grew a dummy-auth dance + a
+   `codex login status` verify with no Claude analogue) and the
+   "shared because both happen to call cp_in then chown" coupling
+   would just rot. Duplication is intentional.
 3. **Env knobs removed.** `BOT_BOTTLE_CONTAINER_HOME`,
    `BOT_BOTTLE_GUEST_HOME`, `BOT_BOTTLE_CONTAINER_SKILLS_DIR`, and
    `BOT_BOTTLE_GUEST_SKILLS_DIR` are gone; `/home/node` is hardcoded