refactor(pipelock): prepare_proxy returns a ProxyPlan

Add a frozen ProxyPlan dataclass to pipelock.py (currently one field:
yaml_path; kept as a class so future proxy-level state has a home).

  - prepare_proxy(spec, stage_dir) now returns pipelock.ProxyPlan
    instead of a raw Path.
  - DockerBottlePlan replaces pipelock_yaml_path + pipelock_yaml_filename
    with a single proxy: ProxyPlan field.
  - launch reads plan.proxy.yaml_path.parent / .name when calling
    pipelock_start. Eventually pipelock_start should just take a Path
    but that's a separate change.

claude_bottle/backend/docker/bottle_plan.py

@@ -12,6 +12,7 @@ from dataclasses import dataclass
 from pathlib import Path
 
 from ...log import info
+from ...pipelock import ProxyPlan
 from .. import BottlePlan
 
 
@@ -30,8 +31,7 @@ class DockerBottlePlan(BottlePlan):
     env_file: Path
     args_file: Path
     prompt_file: Path
-    pipelock_yaml_path: Path
-    pipelock_yaml_filename: str
+    proxy_plan: ProxyPlan
     allowlist_summary: str
     use_runsc: bool