feat(supervise)!: remove egress-block MCP tool and runtime route-mutation

Drops `egress-block` from the supervise sidecar, removes
`_merge_single_route`, `add_route`, and `apply_routes_change` from
egress_apply.py, and strips the proposal/approve/reject flow for egress
from the supervise CLI. The list-egress-routes and capability-block tools
are unaffected. Tests updated throughout.

Closes #198

tests/unit/test_egress_apply.py

@@ -1,27 +1,19 @@
-"""Unit: validate_routes_content (PRD 0014 retargeted by PRD 0017
-chunk 3, PRD 0053). docker exec / cp / kill paths are covered by the
-integration test."""
+"""Unit: validate_routes_content (issue #198: _merge_single_route and
+add_route removed; docker exec / cp / kill paths are covered by the
+integration test)."""
 
 import unittest
 
 from bot_bottle.backend.docker.egress_apply import (
     EgressApplyError,
-    _merge_single_route,
     validate_routes_content,
 )
-from bot_bottle.yaml_subset import parse_yaml_subset
 
 
 _ROUTES_EMPTY = "routes: []\n"
 _ROUTES_ONE = 'routes:\n  - host: "api.anthropic.com"\n'
 
 
-def _routes(parsed: str) -> list[dict]:  # type: ignore
-    """Parse a YAML routes string and pull out the routes list, so
-    tests can assert on shape directly."""
-    return parse_yaml_subset(parsed)["routes"]  # type: ignore
-
-
 class TestValidateRoutesContent(unittest.TestCase):
     def test_accepts_minimal_route_table(self):
         validate_routes_content(_ROUTES_EMPTY)
@@ -60,130 +52,5 @@ class TestValidateRoutesContent(unittest.TestCase):
             )
 
 
-class TestMergeSingleRoute(unittest.TestCase):
-    BASE = _ROUTES_ONE
-
-    def test_appends_route_when_host_absent(self):
-        merged = _merge_single_route(self.BASE, {"host": "github.com"})
-        hosts = [r["host"] for r in _routes(merged)]
-        self.assertEqual(["api.anthropic.com", "github.com"], hosts)
-
-    def test_appends_matches(self):
-        merged = _merge_single_route(
-            self.BASE,
-            {"host": "github.com", "matches": [
-                {"paths": [{"value": "/repos/x/"}]}
-            ]},
-        )
-        new_route = _routes(merged)[-1]
-        self.assertIn("matches", new_route)
-
-    def test_appends_legacy_path_allowlist_as_matches(self):
-        merged = _merge_single_route(
-            self.BASE,
-            {"host": "github.com", "path_allowlist": ["/repos/x/"]},
-        )
-        new_route = _routes(merged)[-1]
-        self.assertIn("matches", new_route)
-
-    def test_appends_auth_with_token_env_slot(self):
-        merged = _merge_single_route(
-            self.BASE,
-            {
-                "host": "api.github.com",
-                "auth": {"scheme": "Bearer", "token_ref": "GH"},
-            },
-        )
-        new_route = _routes(merged)[-1]
-        self.assertEqual("Bearer", new_route["auth_scheme"])
-        self.assertEqual("EGRESS_TOKEN_0", new_route["token_env"])
-
-    def test_auth_slot_increments_past_existing(self):
-        base = (
-            'routes:\n'
-            '  - host: "api.anthropic.com"\n'
-            '    auth_scheme: "Bearer"\n'
-            '    token_env: "EGRESS_TOKEN_0"\n'
-        )
-        merged = _merge_single_route(base, {
-            "host": "api.github.com",
-            "auth": {"scheme": "Bearer", "token_ref": "GH"},
-        })
-        new_route = _routes(merged)[-1]
-        self.assertEqual("EGRESS_TOKEN_1", new_route["token_env"])
-
-    def test_existing_host_merges_match_paths_as_union(self):
-        base = (
-            'routes:\n'
-            '  - host: "github.com"\n'
-            '    matches:\n'
-            '      - paths:\n'
-            '          - value: "/a/"\n'
-        )
-        merged = _merge_single_route(base, {
-            "host": "github.com",
-            "matches": [{"paths": [{"value": "/b/"}]}],
-        })
-        routes = _routes(merged)
-        self.assertEqual(1, len(routes))
-        all_paths: list[str] = []
-        for me in routes[0].get("matches", []):
-            for p in me.get("paths", []):
-                all_paths.append(p["value"])
-        self.assertIn("/a/", all_paths)
-        self.assertIn("/b/", all_paths)
-
-    def test_existing_host_dedup_match_paths(self):
-        base = (
-            'routes:\n'
-            '  - host: "github.com"\n'
-            '    matches:\n'
-            '      - paths:\n'
-            '          - value: "/a/"\n'
-        )
-        merged = _merge_single_route(base, {
-            "host": "github.com",
-            "matches": [{"paths": [{"value": "/a/"}, {"value": "/b/"}]}],
-        })
-        all_paths: list[str] = []
-        for me in _routes(merged)[0].get("matches", []):
-            for p in me.get("paths", []):
-                all_paths.append(p["value"])
-        self.assertEqual(1, all_paths.count("/a/"))
-        self.assertIn("/b/", all_paths)
-
-    def test_existing_host_preserves_existing_auth_ignores_proposed(self):
-        base = (
-            'routes:\n'
-            '  - host: "api.github.com"\n'
-            '    auth_scheme: "Bearer"\n'
-            '    token_env: "EGRESS_TOKEN_0"\n'
-        )
-        merged = _merge_single_route(base, {
-            "host": "api.github.com",
-            "auth": {"scheme": "token", "token_ref": "DIFFERENT"},
-        })
-        route = _routes(merged)[0]
-        self.assertEqual("Bearer", route["auth_scheme"])
-        self.assertEqual("EGRESS_TOKEN_0", route["token_env"])
-
-    def test_host_match_is_case_insensitive(self):
-        base = 'routes:\n  - host: "GitHub.com"\n'
-        merged = _merge_single_route(base, {
-            "host": "github.com",
-            "matches": [{"paths": [{"value": "/x/"}]}],
-        })
-        routes = _routes(merged)
-        self.assertEqual(1, len(routes))
-
-    def test_missing_host_raises(self):
-        with self.assertRaises(EgressApplyError):
-            _merge_single_route(self.BASE, {})
-
-    def test_invalid_current_yaml_raises(self):
-        with self.assertRaises(EgressApplyError):
-            _merge_single_route("routes:\n\tbad", {"host": "x.example"})
-
-
 if __name__ == "__main__":
     unittest.main()