refactor(backend): move AGENT_CA path/bundle constants to shared util

The two Debian-family CA-layout constants lived in
docker/provision/ca.py, which forced the smolmachines backend to
import them cross-backend (smolmachines -> docker). Move them into
the shared backend/util.py next to select_ca_cert; docker, compose,
and smolmachines now all import from there. No behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/docker/provision/ca.py

@@ -33,17 +33,10 @@ from __future__ import annotations
 
 import subprocess
 
-from ...util import log_ca_fingerprint, select_ca_cert
+from ...util import AGENT_CA_PATH, log_ca_fingerprint, select_ca_cert
 from ..bottle_plan import DockerBottlePlan
 
 
-# Debian-family path for sources that `update-ca-certificates` reads.
-# Bundle path is what the command rebuilds and what every standard
-# TLS consumer in the image reads.
-AGENT_CA_PATH = "/usr/local/share/ca-certificates/bot-bottle-mitm-ca.crt"
-AGENT_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"
-
-
 def provision_ca(plan: DockerBottlePlan, target: str) -> None:
     """Copy the agent-facing CA cert into the agent, rebuild the
     trust bundle, emit a one-line fingerprint log. Called from