agent: route remaining home-directory lookups through usershell EnvInfoer

## Problem

`agent/usershell` is the canonical place to resolve a user's home directory and shell, and `usershell.EnvInfoer` is the injectable seam that lets SSH sessions, the process API, and tests override that resolution (host vs container vs deterministic test environment). coder/coder#26102 routed working-directory resolution, MOTD/hushlogin lookup, manifest path expansion, and secret-file injection through `EnvInfoer`, and unexported `usershell.HomeDir`/`usershell.Get` so the host is no longer reachable directly from the resolution path.

Several agent subsystems still call `os.UserHomeDir()` (and `user.Current()`) directly, bypassing the injected `EnvInfoer`. In a container session, or a test with an injected environment, these resolve the host home directory instead of the intended one.

Remaining sites as of coder/coder#26102:

* `agent/agentssh/x11.go` resolving `~/.Xauthority`
* `agent/agentscripts/agentscripts.go` expanding `~` in script log paths
* `agent/agentcontextconfig/resolve.go` expanding `~` in context-config paths
* `agent/agentfiles/ls.go` resolving the home base for `LSRelativityHome`
* `agent/agentcontainers/ignore/dir.go` resolving the global gitignore home

## How to verify

From the coder/coder repo root:

```
grep -rn 'os\.UserHomeDir\|user\.Current' --include='*.go' agent/ | grep -v '/usershell/' | grep -v '_test.go'
```

Every hit outside `agent/usershell` is a direct lookup that does not consult an `EnvInfoer`.

## Desired outcome

These subsystems resolve the home directory through an `EnvInfoer` (the same one already plumbed into the agent), so injected and container environments are honored consistently. After this, the only direct home/user lookups in the agent tree should live inside `agent/usershell`, which backs `SystemEnvInfo`.

## Constraints

* `agent/agentscripts`, `agent/agentcontextconfig`, `agent/agentfiles`, and `agent/agentcontainers/ignore` do not currently receive an `EnvInfoer`. Threading the seam into each is the bulk of the work, and the reason this is split out from coder/coder#26102 rather than bundled in.
* `agent/agentsocket/socket_windows.go` calls `user.Current()` for the current user's SID to set Windows socket ACLs. That is a real OS-identity check, not home/shell resolution, and should stay on the OS user rather than an injectable seam. Leave it as-is.

Follow-up to coder/coder#26102. Parent: coder/internal#1560.

> 🤖 Filed by Coder Agents on behalf of @mafredri.