feat(egress-proxy): block HTTPS git push + restore role provisioner

Two related fixes on top of PR #29's chunk-2 cutover:

1. Universal HTTPS git-push block in the egress-proxy addon
   (`is_git_push_request` in egress_proxy_addon_core, called from the
   mitmproxy request hook before route matching). 403s any
   `/git-receive-pack` or `info/refs?service=git-receive-pack` —
   defense in depth so git-gate (PRD 0008) remains the only outbound
   path for writes, gitleaks-scanned by its pre-receive. Replicates
   cred-proxy's `is_git_push_request` behavior.

2. Restored agent-side role provisioner. Brings back `Role` on
   EgressProxyRoute (manifest + runtime) with three roles —
   `anthropic-base-url`, `npm-registry`, `tea-login`. Singleton
   constraint on the first two carries over from cred-proxy.
   `git-insteadof` is intentionally absent (option 1 above handles
   the push-bypass concern, and the canonical-URL rewrite has no
   function when egress-proxy is on HTTPS_PROXY).

   The provisioner (`backend/docker/provision/egress_proxy.py`):
     - `~/.npmrc` registry= the canonical upstream URL.
     - `~/.config/tea/config.yml` logins[] entry per tea-login route.
     - `ANTHROPIC_BASE_URL` env set in prepare.py based on the
       anthropic-base-url role (was a token_ref="CLAUDE_CODE_OAUTH_TOKEN"
       check in this PR's earlier draft — the role marker is cleaner
       and matches the cred-proxy precedent the user wants kept).

   All three dotfile values point at canonical upstream URLs; the
   agent's HTTPS_PROXY=egress-proxy routes them through the proxy
   automatically.

Tests: 11 new role-validation tests, 11 new provisioner-render tests,
the chunk-1 manifest fixture exercise role=anthropic-base-url. 400
tests pass (was 376).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude_bottle/egress_proxy.py

@@ -62,13 +62,19 @@ class EgressProxyRoute:
     (e.g. `EGRESS_PROXY_TOKEN_0`); `token_ref` is the host env var
     the CLI reads at launch and forwards into the container's environ
     under `token_env`. Routes that share a `token_ref` coalesce to
-    one `token_env` slot."""
+    one `token_env` slot.
+
+    `roles` are the provisioner tags from the manifest route (see
+    `manifest.EGRESS_PROXY_ROLES`). Each tag drives one agent-side
+    dotfile / env rewrite at bottle bring-up. The addon never reads
+    these — they flow through the plan to the host-side provisioner."""
 
     host: str
     path_allowlist: tuple[str, ...] = ()
     auth_scheme: str = ""
     token_env: str = ""
     token_ref: str = ""
+    roles: tuple[str, ...] = ()
 
 
 @dataclass(frozen=True)
@@ -148,11 +154,13 @@ def egress_proxy_routes_for_bottle(
                 auth_scheme=r.AuthScheme,
                 token_env=token_env,
                 token_ref=r.TokenRef,
+                roles=r.Role,
             ))
         else:
             out.append(EgressProxyRoute(
                 host=r.Host,
                 path_allowlist=r.PathAllowlist,
+                roles=r.Role,
             ))
     return tuple(out)