feat(egress-proxy): block HTTPS git push + restore role provisioner

Two related fixes on top of PR #29's chunk-2 cutover:

1. Universal HTTPS git-push block in the egress-proxy addon
   (`is_git_push_request` in egress_proxy_addon_core, called from the
   mitmproxy request hook before route matching). 403s any
   `/git-receive-pack` or `info/refs?service=git-receive-pack` —
   defense in depth so git-gate (PRD 0008) remains the only outbound
   path for writes, gitleaks-scanned by its pre-receive. Replicates
   cred-proxy's `is_git_push_request` behavior.

2. Restored agent-side role provisioner. Brings back `Role` on
   EgressProxyRoute (manifest + runtime) with three roles —
   `anthropic-base-url`, `npm-registry`, `tea-login`. Singleton
   constraint on the first two carries over from cred-proxy.
   `git-insteadof` is intentionally absent (option 1 above handles
   the push-bypass concern, and the canonical-URL rewrite has no
   function when egress-proxy is on HTTPS_PROXY).

   The provisioner (`backend/docker/provision/egress_proxy.py`):
     - `~/.npmrc` registry= the canonical upstream URL.
     - `~/.config/tea/config.yml` logins[] entry per tea-login route.
     - `ANTHROPIC_BASE_URL` env set in prepare.py based on the
       anthropic-base-url role (was a token_ref="CLAUDE_CODE_OAUTH_TOKEN"
       check in this PR's earlier draft — the role marker is cleaner
       and matches the cred-proxy precedent the user wants kept).

   All three dotfile values point at canonical upstream URLs; the
   agent's HTTPS_PROXY=egress-proxy routes them through the proxy
   automatically.

Tests: 11 new role-validation tests, 11 new provisioner-render tests,
the chunk-1 manifest fixture exercise role=anthropic-base-url. 400
tests pass (was 376).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/backend/__init__.py

@@ -219,20 +219,23 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         argv.
 
         Default orchestration: ca → prompt → skills → git →
-        supervise. CA install runs first so the agent's trust store
-        is rebuilt before anything inside the agent makes a TLS call.
-        Subclasses typically don't override this; they implement the
-        sub-methods below.
+        egress_proxy → supervise. CA install runs first so the
+        agent's trust store is rebuilt before anything inside the
+        agent makes a TLS call. egress_proxy runs after git because
+        its provisioner may layer on top of `~/.gitconfig` entries
+        provision_git writes. Subclasses typically don't override
+        this; they implement the sub-methods below.
 
-        PRD 0017: cred-proxy's agent-side dotfile rewrites (~/.npmrc,
-        ~/.gitconfig insteadOf, tea config) are gone. Egress-proxy is
-        on the agent's HTTP_PROXY path so every tool that respects
-        HTTPS_PROXY (claude-code, git over HTTPS, npm, curl) is
-        intercepted without per-tool reconfiguration."""
+        PRD 0017: most agent-side rewrites (HTTPS routing) are
+        obsolete because egress-proxy sits on the HTTPS_PROXY path.
+        The remaining rewrites — npm registry, tea config,
+        ANTHROPIC_BASE_URL — exist for tools that need an explicit
+        URL config rather than just respecting HTTPS_PROXY."""
         self.provision_ca(plan, target)
         prompt_path = self.provision_prompt(plan, target)
         self.provision_skills(plan, target)
         self.provision_git(plan, target)
+        self.provision_egress_proxy(plan, target)
         self.provision_supervise(plan, target)
         return prompt_path
 
@@ -262,6 +265,12 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         """Copy the host's cwd `.git` directory into the running
         bottle if the user requested --cwd. No-op otherwise."""
 
+    def provision_egress_proxy(self, plan: PlanT, target: str) -> None:
+        """Drop the agent-side dotfiles driven by `egress_proxy.routes[].role`
+        per PRD 0017 (~/.npmrc, ~/.config/tea/config.yml). Default
+        impl is a no-op for backends that don't yet support the
+        egress-proxy sidecar; the Docker backend overrides."""
+
     def provision_supervise(self, plan: PlanT, target: str) -> None:
         """Write the in-bottle Claude Code MCP config so the agent
         discovers the per-bottle supervise sidecar (PRD 0013).