refactor!: rename project to bot-bottle

Assisted-by: Codex

docs/research/local-vs-remote-agent-execution.md

@@ -2,7 +2,7 @@
 
 Research notes on when to run containerized Claude Code agents on a remote machine
 outside the local network versus inside it, focusing on security and privacy concerns.
-Relevant to a potential claude-bottle extension for remote agent execution.
+Relevant to a potential bot-bottle extension for remote agent execution.
 
 ---
 
@@ -16,7 +16,7 @@ escapes**, and **whether credentials are short-lived and scoped**.
 
 ## Threat landscape by topology
 
-### Local (current claude-bottle model)
+### Local (current bot-bottle model)
 
 - Container escape → developer laptop → `~/.ssh`, `~/.aws`, browser cookies, Keychain, everything
 - Outbound: Docker containers have full internet access by default; no egress monitoring on most home networks
@@ -99,7 +99,7 @@ Key insight: once a container is compromised via prompt injection, the blast rad
 
 ## Credentials and secrets
 
-### Local topology (current claude-bottle)
+### Local topology (current bot-bottle)
 
 - Secrets live in the host environment or are prompted from `/dev/tty`
 - Forwarded to containers via `-e NAME` (not `=value`), never on argv, never in env-files for secrets
@@ -125,10 +125,10 @@ An 8,640x reduction in abuse window comes from switching from 90-day keys to 15-
 ### Local topology
 
 - Monitoring: whatever the home/office router supports — usually minimal
-- Containment: `--network none` + a proxy socket provides the strongest containment; claude-bottle does not currently do this
+- Containment: `--network none` + a proxy socket provides the strongest containment; bot-bottle does not currently do this
 - DLP: essentially none unless specifically deployed on the LAN
 - Domain fronting risk: even allowlisted-domain proxies can be bypassed via domain fronting — an agent that can reach `api.anthropic.com` could relay data to an attacker-controlled backend through that domain
-- **claude-bottle today: containers have full outbound internet access. No egress restrictions.**
+- **bot-bottle today: containers have full outbound internet access. No egress restrictions.**
 
 ### Remote topology (cloud VM)
 
@@ -177,7 +177,7 @@ Strongest exfiltration controls for either topology:
 
 ---
 
-## Concrete recommendations if extending claude-bottle for remote
+## Concrete recommendations if extending bot-bottle for remote
 
 1. **Never build the VPN-pivot pattern.** A remote agent connected back to the LAN via VPN is the worst of both worlds. If a remote agent needs LAN resources, expose those through a narrow API, not a VPN.
 
@@ -199,7 +199,7 @@ Strongest exfiltration controls for either topology:
 
 ## Bottom line
 
-For the current claude-bottle use case (developer feature implementation, no regulated data,
+For the current bot-bottle use case (developer feature implementation, no regulated data,
 single developer), local execution is the right default. The biggest unaddressed risk
 right now isn't topology — it's that containers have unrestricted outbound internet access.
 Adding `--network none` + a proxy socket would be higher-leverage than any topology change.