feat(supervise): MCP sidecar HTTP server + Dockerfile (PRD 0013)

Phase 2 of PRD 0013. Adds the in-container MCP server:

- claude_bottle/supervise_server.py: minimal JSON-RPC over HTTP MCP
  server. Handles initialize / notifications/initialized / tools/list /
  tools/call. Each tools/call validates the proposed file syntactically,
  writes a Proposal to the host-mounted queue, blocks waiting for a
  Response, archives both files, returns the operator's {status, notes}
  wrapped in MCP content.
- Three tool definitions with JSON Schema inputs: cred-proxy-block
  (routes.json), pipelock-block (allowlist), capability-block
  (Dockerfile).
- Dockerfile.supervise mirroring the cred-proxy pattern: same pinned
  python:3.13-alpine, copies supervise.py + supervise_server.py into
  /app, exposes port 9100.

Stdlib-only. Tests cover JSON-RPC parsing, per-tool validation, all
three handlers, the queue round-trip via a background responder
thread, and an end-to-end HTTP sanity check on a random port.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile.supervise

@@ -0,0 +1,32 @@
+# Per-bottle supervise sidecar image (PRD 0013).
+#
+# Exposes three MCP tools (cred-proxy-block, pipelock-block,
+# capability-block) the agent calls to propose config changes when
+# stuck. Each tool call writes a Proposal to a host-mounted queue
+# dir and blocks waiting for the operator's Response.
+#
+# Stdlib-only Python. The bottle slug arrives via
+# SUPERVISE_BOTTLE_SLUG; the host's ~/.claude-bottle/queue/<slug>/
+# is bind-mounted at /run/supervise/queue.
+
+# python:3.13-alpine, pinned by digest (same image cred-proxy uses,
+# so docker pulls / caches once for both sidecars).
+FROM python@sha256:420cd0bf0f3998275875e02ecd5808168cf0843cbb4d3c536432f729247b2acc
+
+# Both files ship as single files into /app; supervise_server.py
+# imports supervise via same-directory resolution.
+COPY claude_bottle/supervise.py /app/supervise.py
+COPY claude_bottle/supervise_server.py /app/supervise_server.py
+
+# Pre-create the queue mount point so docker's bind-mount has a
+# parent dir. Matches Dockerfile.cred-proxy's pattern.
+RUN mkdir -p /run/supervise/queue
+
+EXPOSE 9100
+
+# WORKDIR makes the in-app same-dir import deterministic regardless
+# of how the container is launched.
+WORKDIR /app
+
+# PID 1 is python for clean signal handling and exit codes.
+ENTRYPOINT ["python3", "/app/supervise_server.py"]