fix(egress-proxy): force traffic through pipelock + block unallowlisted hosts

Two issues stopping the bottle's egress allowlist from being
enforced:

1. mitmproxy was bypassing pipelock. We set HTTPS_PROXY=pipelock
   in the egress-proxy container's env, but mitmproxy is a proxy
   *server* — it does NOT honor HTTP(S)_PROXY env vars on its
   outbound side the way HTTP-client libraries do. All
   post-MITM traffic was going direct to the upstream, never
   touching pipelock's hostname allowlist or DLP scanner.

   Fix: use mitmproxy's `--mode upstream:URL` flag. The Dockerfile
   entrypoint now reads a new `EGRESS_PROXY_UPSTREAM_PROXY` env
   (set by `DockerEgressProxy.start` to the pipelock URL when
   pipelock is in the topology) and switches mitmdump to
   upstream-proxy mode. Standalone runs of the image without the
   env still get `--mode regular@9099` direct-to-upstream — useful
   for unit-test boots. Confirmed in the boot log: "HTTP(S) proxy
   (upstream mode) listening at *:9099."

2. egress-proxy was forwarding unrecognized hosts. The addon's
   `decide()` returned `Decision(action="forward")` whenever no
   route matched the request host, deferring to pipelock to gate.
   With #1 broken pipelock wasn't gating either; even with #1
   fixed, defense-in-depth wants both layers enforcing.

   Fix: no-route-match → 403 with a "host not in allowlist"
   reason. The egress allowlist is now strictly the set of hosts
   declared in `bottle.egress_proxy.routes`; bare-pass routes
   (host with no auth, no path_allowlist) cover the passthrough
   case for hosts that just need reach. path_allowlist enforcement
   on matched routes is unchanged.

Test updated: `test_no_matching_route_forwards` →
`test_no_matching_route_blocks`. 364 unit tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_proxy_addon_core.py

@@ -190,20 +190,30 @@ def decide(
     """Pure decision: given a route table + request host + path + env,
     return what the addon should do with the request.
 
-    - No matching route → forward unchanged. Pipelock will
-      hostname-gate it downstream; egress-proxy does not need to
-      decide on hosts it doesn't recognise.
+    - No matching route → BLOCK. The route table is the bottle's
+      egress allowlist; defense-in-depth complements pipelock's
+      hostname gate on the downstream leg. A bottle that wants a
+      host reachable from the agent must declare a route for it
+      (bare-pass route — no `auth`, no `path_allowlist` — is fine
+      for hosts that just need passthrough).
     - Matching route with `path_allowlist` set, request path doesn't
       start with any of the allowed prefixes → block with a clear
       reason.
     - Matching route with an auth pair → forward + inject
       Authorization. Token comes from `environ[route.token_env]`;
-      missing/empty values 500 (route declared auth but the secret
+      missing/empty values block (route declared auth but the secret
       isn't here — operator misconfig).
     """
     route = match_route(routes, request_host)
     if route is None:
-        return Decision(action="forward")
+        return Decision(
+            action="block",
+            reason=(
+                f"egress-proxy: host {request_host!r} is not in the "
+                f"bottle's egress_proxy.routes allowlist. Declare a "
+                f"route for it or remove the request."
+            ),
+        )
 
     if route.path_allowlist:
         if not any(request_path.startswith(p) for p in route.path_allowlist):