Fix managed Kimaki self-upgrades

[chubes4]

Summary

• install managed non-root Kimaki into a prefix owned by the configured service user
• render systemd ExecStart, PATH, and npm_config_prefix against that writable installation
• converge existing root-global/non-root-service installations without weakening permissions or adding sudo grants
• preserve root-service, local, external WordPress, and multi-instance behavior

Fixes #580. Related to #203.

Verification

• bash tests/kimaki-install-existing.sh (28 assertions)
• bash tests/service-identity-adoption.sh (27 assertions)
• bash tests/bridge-render.sh
• bash -n bridges/kimaki.sh tests/kimaki-install-existing.sh tests/service-identity-adoption.sh
• git diff --check
• Homeboy audit: zero introduced findings

tests/service-migration.sh retains four pre-existing macOS fixture failures that reproduce unchanged on main; this change does not touch those paths.

---

AI assistance disclosure: xAI Grok 4.6 via OpenCode and Homeboy produced the initial candidate; GPT-5.6 Sol via OpenCode reviewed it, corrected identity/error handling and test isolation, and ran verification under Chris Huber direction.