docs: replace stale .sh paths with claude_bottle/*.py equivalents

Cleans up references to the pre-refactor bash layout (cli.sh,
lib/*.sh, scripts/*.sh) across README, Dockerfile, the pipelock PRD,
and research notes. Refreshes line numbers in the oauth-token note
against the current cli/start.py.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/research/network-egress-guard.md

@@ -234,7 +234,7 @@ which does not work on macOS Desktop.
 
 Moderate. The script itself is well-understood and can be lifted nearly
 verbatim from Anthropic's devcontainer repo. The integration points in
-`cli.sh` are:
+`cli.py` are:
 
 1. Pass `--cap-add NET_ADMIN --cap-add NET_RAW` in the `docker run` invocation.
 2. `docker cp` an `init-firewall.sh` script into the container (alongside