fix(manifest): presence-aware runtime merge for nested_containers

The runtime merge (merge_bottles_runtime / _fold_two_bottles) was using
OR semantics for nested_containers, which meant `nested_containers: false`
in a later bottle could never override an earlier `true`.

Fix: add `nested_containers_explicit: bool` to ManifestBottle, set to
True only when the key is present in the source dict. The runtime merge
functions now use the override's value only when it was explicitly
supplied; otherwise the base's value is preserved. This matches the
documented last-wins / presence-aware semantics used by supervise and
agent_provider, and aligns with _merge_bottles (the file-based extends
path) which already did presence checks via `"nested_containers" in
child_raw`.

Tests: rename existing test to clarify the preserved-when-omitted case,
add explicit-false-overrides-true and explicit-true-overrides-false cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bot_bottle/manifest_bottle.py

@@ -49,6 +49,12 @@ class ManifestBottle:
     # costs image weight, a resident service, and relaxed guest device modes
     # that the majority of bottles never need.
     nested_containers: bool = False
+    # True when nested_containers was explicitly present in the source dict.
+    # Used by the runtime merge path to distinguish "omitted → default False"
+    # from "explicitly set to False", so an explicit false in a later bottle
+    # can override an earlier true while a bottle that never mentions the key
+    # does not silently drop the capability.
+    nested_containers_explicit: bool = False
 
     @classmethod
     def from_dict(cls, name: str, raw: object) -> "ManifestBottle":
@@ -139,4 +145,5 @@ class ManifestBottle:
             env=env, agent_provider=agent_provider, git=git,
             git_user=git_user, egress=egress, supervise=supervise_raw,
             nested_containers=nested_raw,
+            nested_containers_explicit="nested_containers" in d,
         )