refactor(egress): write routes.yaml as actual YAML, not JSON-in-yml

`egress_render_routes` now emits hand-rolled YAML in the same style
as `pipelock_render_yaml`. The egress addon parses it via
`yaml_subset.parse_yaml_subset` — the same parser the manifest
loader + pipelock_apply use.

Why bother: routes.yaml is bind-mounted into the egress sidecar
AND surfaced to operators through `routes edit` (PRD 0019). JSON-
in-yml renders ugly in $EDITOR and signals "this is data" rather
than "this is config you can read at a glance". Real YAML reads
cleanly.

Mechanics:

  - `yaml_subset.py` drops its `claude_bottle.log` dependency.
    Errors now raise `YamlSubsetError` (a `ValueError`); the
    manifest loader + pipelock_apply catch it at the boundary
    and forward to `die` / `PipelockApplyError` so callers see
    the same behavior they did before.
  - `Dockerfile.egress` adds one COPY line for `yaml_subset.py`
    so it sits flat in `/app/` next to the addon. The addon
    uses an absolute-import-with-fallback shim so the same file
    works inside the container AND from the host's unit tests.
  - `egress_apply._merge_single_route` round-trips current
    routes.yaml through `parse_yaml_subset` + a new
    `_render_routes_payload` helper instead of `json.loads` +
    `json.dumps`.

End-to-end: rebuilt the egress image, ran `./cli.py start` to a
full bring-up, confirmed the addon's boot log shows `egress:
loaded 9 route(s)` — i.e., the YAML parses inside the container.
453 unit + 3 integration tests pass.

tests/unit/test_egress_apply.py

@@ -4,8 +4,6 @@ integration test."""
 
 import unittest
 
-import json
-
 from claude_bottle.backend.docker.egress_apply import (
     EgressApplyError,
     _hosts_in_routes,
@@ -13,56 +11,68 @@ from claude_bottle.backend.docker.egress_apply import (
     _pipelock_safe_hosts,
     validate_routes_content,
 )
+from claude_bottle.yaml_subset import parse_yaml_subset
+
+
+# YAML fixtures matching the hand-rolled `_render_routes_payload`
+# shape. Per-test custom shapes are spelled inline; these are the
+# common ones.
+_ROUTES_EMPTY = "routes: []\n"
+_ROUTES_ONE = 'routes:\n  - host: "api.anthropic.com"\n'
+
+
+def _routes(parsed: str) -> list[dict]:
+    """Parse a YAML routes string and pull out the routes list, so
+    tests can assert on shape directly."""
+    return parse_yaml_subset(parsed)["routes"]
 
 
 class TestValidateRoutesContent(unittest.TestCase):
     def test_accepts_minimal_route_table(self):
-        validate_routes_content('{"routes": []}')
-        validate_routes_content(
-            '{"routes": [{"host": "api.github.com"}]}'
-        )
+        validate_routes_content(_ROUTES_EMPTY)
+        validate_routes_content(_ROUTES_ONE)
 
     def test_accepts_full_route(self):
         validate_routes_content(
-            '{"routes": [{"host": "api.github.com",'
-            ' "path_allowlist": ["/repos/x/"],'
-            ' "auth_scheme": "Bearer",'
-            ' "token_env": "EGRESS_TOKEN_0"}]}'
+            'routes:\n'
+            '  - host: "api.github.com"\n'
+            '    auth_scheme: "Bearer"\n'
+            '    token_env: "EGRESS_TOKEN_0"\n'
+            '    path_allowlist:\n'
+            '      - "/repos/x/"\n'
         )
 
-    def test_rejects_bad_json(self):
+    def test_rejects_bad_yaml(self):
         with self.assertRaises(EgressApplyError) as cm:
-            validate_routes_content("{not json")
+            validate_routes_content("routes:\n\t- host: x\n")
         self.assertIn("not valid", str(cm.exception))
 
-    def test_rejects_non_object_top_level(self):
-        with self.assertRaises(EgressApplyError):
-            validate_routes_content("[]")
-
     def test_rejects_missing_routes_key(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content('{"other": []}')
+            validate_routes_content("other: []\n")
 
     def test_rejects_non_list_routes(self):
         with self.assertRaises(EgressApplyError):
-            validate_routes_content('{"routes": "not a list"}')
+            validate_routes_content('routes: "not a list"\n')
 
     def test_rejects_partial_auth_pair(self):
         # The addon-core parser enforces both-or-neither — the apply
         # path picks this up before SIGHUP'ing the sidecar.
         with self.assertRaises(EgressApplyError):
             validate_routes_content(
-                '{"routes": [{"host": "x.example",'
-                ' "auth_scheme": "Bearer"}]}'
+                'routes:\n'
+                '  - host: "x.example"\n'
+                '    auth_scheme: "Bearer"\n'
             )
 
 
 class TestHostsInRoutes(unittest.TestCase):
     def test_extracts_each_unique_host(self):
         hosts = _hosts_in_routes(
-            '{"routes": [{"host": "api.github.com"},'
-            ' {"host": "github.com"},'
-            ' {"host": "api.anthropic.com"}]}'
+            'routes:\n'
+            '  - host: "api.github.com"\n'
+            '  - host: "github.com"\n'
+            '  - host: "api.anthropic.com"\n'
         )
         # Sorted+deduped.
         self.assertEqual(
@@ -72,28 +82,34 @@ class TestHostsInRoutes(unittest.TestCase):
 
     def test_dedupes_same_host(self):
         hosts = _hosts_in_routes(
-            '{"routes": [{"host": "x.example", "path_allowlist": ["/a/"]},'
-            ' {"host": "x.example", "path_allowlist": ["/b/"]}]}'
+            'routes:\n'
+            '  - host: "x.example"\n'
+            '    path_allowlist:\n'
+            '      - "/a/"\n'
+            '  - host: "x.example"\n'
+            '    path_allowlist:\n'
+            '      - "/b/"\n'
         )
         self.assertEqual(["x.example"], hosts)
 
     def test_empty_routes_returns_empty(self):
-        self.assertEqual([], _hosts_in_routes('{"routes": []}'))
+        self.assertEqual([], _hosts_in_routes(_ROUTES_EMPTY))
 
     def test_invalid_routes_raises(self):
         # The mirror helper relies on parsing succeeding; bad input
         # should error before pipelock is touched.
         with self.assertRaises(EgressApplyError):
-            _hosts_in_routes('{"routes": [{"path": "/no-host/"}]}')
+            _hosts_in_routes(
+                'routes:\n  - path_allowlist:\n    - "/no-host/"\n'
+            )
 
 
 class TestMergeSingleRoute(unittest.TestCase):
-    BASE = '{"routes": [{"host": "api.anthropic.com"}]}'
+    BASE = _ROUTES_ONE
 
     def test_appends_route_when_host_absent(self):
         merged = _merge_single_route(self.BASE, {"host": "github.com"})
-        routes = json.loads(merged)["routes"]
-        hosts = [r["host"] for r in routes]
+        hosts = [r["host"] for r in _routes(merged)]
         self.assertEqual(["api.anthropic.com", "github.com"], hosts)
 
     def test_appends_path_allowlist(self):
@@ -101,7 +117,7 @@ class TestMergeSingleRoute(unittest.TestCase):
             self.BASE,
             {"host": "github.com", "path_allowlist": ["/repos/x/"]},
         )
-        new_route = json.loads(merged)["routes"][-1]
+        new_route = _routes(merged)[-1]
         self.assertEqual(["/repos/x/"], new_route["path_allowlist"])
 
     def test_appends_auth_with_token_env_slot(self):
@@ -112,72 +128,80 @@ class TestMergeSingleRoute(unittest.TestCase):
                 "auth": {"scheme": "Bearer", "token_ref": "GH"},
             },
         )
-        new_route = json.loads(merged)["routes"][-1]
+        new_route = _routes(merged)[-1]
         self.assertEqual("Bearer", new_route["auth_scheme"])
         # First auth slot when no prior auth routes exist.
         self.assertEqual("EGRESS_TOKEN_0", new_route["token_env"])
 
     def test_auth_slot_increments_past_existing(self):
-        base = json.dumps({"routes": [
-            {"host": "api.anthropic.com",
-             "auth_scheme": "Bearer",
-             "token_env": "EGRESS_TOKEN_0"},
-        ]})
+        base = (
+            'routes:\n'
+            '  - host: "api.anthropic.com"\n'
+            '    auth_scheme: "Bearer"\n'
+            '    token_env: "EGRESS_TOKEN_0"\n'
+        )
         merged = _merge_single_route(base, {
             "host": "api.github.com",
             "auth": {"scheme": "Bearer", "token_ref": "GH"},
         })
-        new_route = json.loads(merged)["routes"][-1]
+        new_route = _routes(merged)[-1]
         self.assertEqual("EGRESS_TOKEN_1", new_route["token_env"])
 
     def test_existing_host_merges_path_allowlist_as_union(self):
-        base = json.dumps({"routes": [
-            {"host": "github.com", "path_allowlist": ["/a/"]},
-        ]})
+        base = (
+            'routes:\n'
+            '  - host: "github.com"\n'
+            '    path_allowlist:\n'
+            '      - "/a/"\n'
+        )
         merged = _merge_single_route(base, {
             "host": "github.com",
             "path_allowlist": ["/b/"],
         })
-        routes = json.loads(merged)["routes"]
+        routes = _routes(merged)
         self.assertEqual(1, len(routes))  # not duplicated
         self.assertEqual(["/a/", "/b/"], routes[0]["path_allowlist"])
 
     def test_existing_host_dedup_path_allowlist(self):
-        base = json.dumps({"routes": [
-            {"host": "github.com", "path_allowlist": ["/a/"]},
-        ]})
+        base = (
+            'routes:\n'
+            '  - host: "github.com"\n'
+            '    path_allowlist:\n'
+            '      - "/a/"\n'
+        )
         merged = _merge_single_route(base, {
             "host": "github.com",
             "path_allowlist": ["/a/", "/b/"],
         })
         self.assertEqual(
             ["/a/", "/b/"],
-            json.loads(merged)["routes"][0]["path_allowlist"],
+            _routes(merged)[0]["path_allowlist"],
         )
 
     def test_existing_host_preserves_existing_auth_ignores_proposed(self):
         # Tool docs: auth on an existing host is operator-controlled,
         # not agent-controlled. The merge must not overwrite.
-        base = json.dumps({"routes": [
-            {"host": "api.github.com",
-             "auth_scheme": "Bearer",
-             "token_env": "EGRESS_TOKEN_0"},
-        ]})
+        base = (
+            'routes:\n'
+            '  - host: "api.github.com"\n'
+            '    auth_scheme: "Bearer"\n'
+            '    token_env: "EGRESS_TOKEN_0"\n'
+        )
         merged = _merge_single_route(base, {
             "host": "api.github.com",
             "auth": {"scheme": "token", "token_ref": "DIFFERENT"},
         })
-        route = json.loads(merged)["routes"][0]
+        route = _routes(merged)[0]
         self.assertEqual("Bearer", route["auth_scheme"])
         self.assertEqual("EGRESS_TOKEN_0", route["token_env"])
 
     def test_host_match_is_case_insensitive(self):
-        base = json.dumps({"routes": [{"host": "GitHub.com"}]})
+        base = 'routes:\n  - host: "GitHub.com"\n'
         merged = _merge_single_route(base, {
             "host": "github.com",
             "path_allowlist": ["/x/"],
         })
-        routes = json.loads(merged)["routes"]
+        routes = _routes(merged)
         self.assertEqual(1, len(routes))
         self.assertEqual(["/x/"], routes[0]["path_allowlist"])
 
@@ -187,7 +211,7 @@ class TestMergeSingleRoute(unittest.TestCase):
 
     def test_invalid_current_yaml_raises(self):
         with self.assertRaises(EgressApplyError):
-            _merge_single_route("{not json", {"host": "x.example"})
+            _merge_single_route("routes:\n\tbad", {"host": "x.example"})
 
 
 class TestPipelockSafeHosts(unittest.TestCase):