refactor(egress): write routes.yaml as actual YAML, not JSON-in-yml

`egress_render_routes` now emits hand-rolled YAML in the same style
as `pipelock_render_yaml`. The egress addon parses it via
`yaml_subset.parse_yaml_subset` — the same parser the manifest
loader + pipelock_apply use.

Why bother: routes.yaml is bind-mounted into the egress sidecar
AND surfaced to operators through `routes edit` (PRD 0019). JSON-
in-yml renders ugly in $EDITOR and signals "this is data" rather
than "this is config you can read at a glance". Real YAML reads
cleanly.

Mechanics:

  - `yaml_subset.py` drops its `claude_bottle.log` dependency.
    Errors now raise `YamlSubsetError` (a `ValueError`); the
    manifest loader + pipelock_apply catch it at the boundary
    and forward to `die` / `PipelockApplyError` so callers see
    the same behavior they did before.
  - `Dockerfile.egress` adds one COPY line for `yaml_subset.py`
    so it sits flat in `/app/` next to the addon. The addon
    uses an absolute-import-with-fallback shim so the same file
    works inside the container AND from the host's unit tests.
  - `egress_apply._merge_single_route` round-trips current
    routes.yaml through `parse_yaml_subset` + a new
    `_render_routes_payload` helper instead of `json.loads` +
    `json.dumps`.

End-to-end: rebuilt the egress image, ran `./cli.py start` to a
full bring-up, confirmed the addon's boot log shows `egress:
loaded 9 route(s)` — i.e., the YAML parses inside the container.
453 unit + 3 integration tests pass.

claude_bottle/backend/docker/egress_apply.py

@@ -31,6 +31,7 @@ from pathlib import Path
 
 from ...egress import EGRESS_ROUTES_IN_CONTAINER
 from ...egress_addon_core import load_routes
+from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import egress_state_dir
 from .egress import egress_container_name
 from .pipelock_apply import (
@@ -42,6 +43,30 @@ from .pipelock_apply import (
 )
 
 
+def _render_routes_payload(routes_list: list[dict[str, object]]) -> str:
+    """Render a list-of-dicts routes payload as YAML matching the
+    shape `egress_render_routes` produces. The apply path
+    round-trips current routes.yaml through this so the file the
+    sidecar sees stays in the YAML format the addon expects."""
+    if not routes_list:
+        return "routes: []\n"
+    lines: list[str] = ["routes:"]
+    for entry in routes_list:
+        host = str(entry.get("host", ""))
+        lines.append(f'  - host: "{host}"')
+        auth_scheme = entry.get("auth_scheme")
+        token_env = entry.get("token_env")
+        if auth_scheme and token_env:
+            lines.append(f'    auth_scheme: "{auth_scheme}"')
+            lines.append(f'    token_env: "{token_env}"')
+        paths = entry.get("path_allowlist") or []
+        if paths:
+            lines.append("    path_allowlist:")
+            for p in paths:
+                lines.append(f'      - "{p}"')
+    return "\n".join(lines) + "\n"
+
+
 def _egress_routes_host_path(slug: str) -> Path:
     """The bind-mount source for the egress sidecar's routes.yaml.
     Must match what egress.prepare wrote at chunk-2 paths."""
@@ -219,7 +244,7 @@ def _merge_single_route(
     current_yaml: str, new_route: dict[str, object],
 ) -> str:
     """Merge a single proposed route into the current routes.yaml
-    content, returning the merged JSON-as-yaml string.
+    content, returning the merged YAML string.
 
     Behavior:
       - If `new_route['host']` is NOT in the current routes →
@@ -230,15 +255,15 @@ def _merge_single_route(
         on an existing host are ignored, matching the tool's
         documented semantics.
 
-    The supervisor renders the merged routes.yaml with the same
-    JSON layout the addon expects (host + path_allowlist +
-    auth_scheme + token_env). Token VALUES never appear here; the
-    routes file carries only env-var slot NAMES."""
+    Round-trips the file through `yaml_subset` (the same parser
+    the addon uses), so the merged output is in the YAML format
+    the sidecar reads. Token VALUES never appear here; the routes
+    file carries only env-var slot NAMES."""
     try:
-        cfg = json.loads(current_yaml)
-    except json.JSONDecodeError as e:
+        cfg = parse_yaml_subset(current_yaml)
+    except YamlSubsetError as e:
         raise EgressApplyError(
-            f"current routes.yaml is not valid JSON: {e}"
+            f"current routes.yaml is not valid YAML: {e}"
         ) from e
     routes = cfg.get("routes")
     if not isinstance(routes, list):
@@ -299,8 +324,7 @@ def _merge_single_route(
             # the slot name they'll need to provision.
         routes.append(entry)
 
-    cfg["routes"] = routes
-    return json.dumps(cfg, indent=2) + "\n"
+    return _render_routes_payload(routes)
 
 
 def add_route(slug: str, proposed_route_json: str) -> tuple[str, str]:

claude_bottle/backend/docker/pipelock_apply.py

@@ -23,7 +23,7 @@ import tempfile
 from pathlib import Path
 
 from ...pipelock import pipelock_render_yaml
-from ...yaml_subset import parse_yaml_subset
+from ...yaml_subset import YamlSubsetError, parse_yaml_subset
 from .bottle_state import pipelock_state_dir
 from .pipelock import pipelock_container_name
 
@@ -110,7 +110,10 @@ def fetch_current_allowlist(slug: str) -> str:
     line — the operator-facing format for the TUI / agent's
     current-config mount."""
     yaml = fetch_current_yaml(slug)
-    cfg = parse_yaml_subset(yaml)
+    try:
+        cfg = parse_yaml_subset(yaml)
+    except YamlSubsetError as e:
+        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
     hosts = cfg.get("api_allowlist", [])
     if not isinstance(hosts, list):
         raise PipelockApplyError(
@@ -136,7 +139,10 @@ def apply_allowlist_change(
     new_hosts = parse_allowlist_content(new_allowlist_content)
     container = pipelock_container_name(slug)
     current_yaml = fetch_current_yaml(slug)
-    cfg = parse_yaml_subset(current_yaml)
+    try:
+        cfg = parse_yaml_subset(current_yaml)
+    except YamlSubsetError as e:
+        raise PipelockApplyError(f"running pipelock yaml: {e}") from e
     current_hosts = cfg.get("api_allowlist", [])
     if not isinstance(current_hosts, list):
         raise PipelockApplyError(