refactor(pipelock): take stage_dir, derive yaml_path internally

PipelockProxy.prepare now accepts (bottle, slug, stage_dir) and derives
the yaml_path itself, so callers don't need to know the filename.
DockerBottleBackend.prepare_proxy becomes a one-line wrapper whose only
caller already has bottle and slug in scope, so it's inlined and
deleted.

tests/integration/test_pipelock_sidecar_smoke.py

@@ -68,8 +68,7 @@ class TestPipelockSidecarSmoke(unittest.TestCase):
     def test_prepare_and_start_yield_healthy_sidecar(self):
         proxy = DockerPipelockProxy()
 
-        yaml_path = self.work_dir / "pipelock.yaml"
-        prep = proxy.prepare(fixture_minimal().bottles["dev"], self.slug, yaml_path)
+        prep = proxy.prepare(fixture_minimal().bottles["dev"], self.slug, self.work_dir)
 
         self.internal_net = network_create_internal(self.slug)
         self.egress_net = network_create_egress(self.slug)