refactor(manifest): remove empty EGRESS_ROLES and related plumbing

EGRESS_ROLES, EGRESS_SINGLETON_ROLES, and PROVIDER_EGRESS_ROLES were
all empty frozensets after the codex_auth and claude_code_oauth roles
were removed. Delete the constants and all validation code that iterated
over them (the singleton-role loop and provider-role check in
_validate_egress_routes, the EGRESS_ROLES membership test in
EgressRoute.from_dict). EgressRoute.from_dict now rejects any role
string unconditionally; _validate_egress_routes loses its
agent_provider_template parameter entirely.

Assisted-by: Claude Code

bot_bottle/egress.py

@@ -69,9 +69,8 @@ class EgressRoute:
     under `token_env`. Routes that share a `token_ref` coalesce to
     one `token_env` slot.
 
-    `roles` carries the manifest route's optional role markers (see
-    `manifest.EGRESS_ROLES`). The launch step reads these for
-    side effects like the claude-code OAuth placeholder env.
+    `roles` carries the manifest route's role tuple (reserved for
+    future use; always empty today).
 
     `tls_passthrough` signals that pipelock must not TLS-MITM this
     host — either because the manifest declared `pipelock.tls_passthrough: