refactor(util): split private helpers off DockerBottleBackend

New file claude_bottle/backend/util.py for cross-backend host-side
helpers:
  host_skill_dir(name) — resolves $HOME/.claude/skills/<name>

docker/util.py gains:
  docker_exec_root(container, argv) — `docker exec -u 0` wrapper used
    by SSH provisioning

DockerBottleBackend drops the two methods that wrapped these
(`_host_skill_dir`, `_docker_exec_root`) — they had no instance state
and just lived on the class for organizational reasons. Call sites
now use the imported functions directly.

claude_bottle/backend/docker/util.py

@@ -48,6 +48,16 @@ def container_exists(name: str) -> bool:
     return bool(result.stdout.strip())
 
 
+def docker_exec_root(container: str, argv: list[str]) -> None:
+    """Run `docker exec -u 0` in the named container, check=True. Used
+    by SSH provisioning to chown/chmod files that need root."""
+    subprocess.run(
+        ["docker", "exec", "-u", "0", container, *argv],
+        stdout=subprocess.DEVNULL,
+        check=True,
+    )
+
+
 _SLUG_RE = re.compile(r"[^a-z0-9]+")