shell: centralize remaining runtime path/user constants

[benvinegar]

Problem

We introduced bin/lib/paths-common.sh for shared path constants, but several high-traffic scripts still hardcode baudbot_agent, /home/baudbot_agent, and /opt/baudbot values.

This creates drift risk when defaults change and makes future refactors harder.

Proposed solution

• Adopt bb_init_paths/bb_refresh_release_paths (or equivalent shared env initialization) in remaining shell entrypoints and helper modules.
• Replace hardcoded path/user literals with exported variables (BAUDBOT_AGENT_USER, BAUDBOT_AGENT_HOME, BAUDBOT_RELEASE_ROOT, etc.).
• For static unit files/wrappers that cannot source shell helpers, generate or template them from a single source of truth (or document why they remain static).
• Add regression tests for any touched behavior (especially fallback resolution in bin/baudbot).

Helpful context

Examples of remaining hardcoded references:

• bin/baudbot: /opt/baudbot/current, /home/..., sudo -u baudbot_agent
• bin/lib/baudbot-runtime.sh: /home/$agent_user/..., /opt/baudbot/current, fixed baudbot_agent references in status helpers
• bin/baudbot.service: hardcoded User=baudbot_agent, WorkingDirectory=/home/baudbot_agent, ReadOnlyPaths=/opt/baudbot
• bin/baudbot-firewall.service: hardcoded id -u baudbot_agent
• bin/env.sh: still defaults AGENT_USER directly instead of consistently consuming shared path init

Related PR context: #113 (path constant centralization)