fix(agent): write nginx pid and temp dirs under data_dir for non-root runtime

OpenResty running as openflare can no longer write pid or client/proxy temp
paths under the OpenResty install prefix. Templates and apply-time rendering
now use __OPENFLARE_PID_PATH__ and __OPENFLARE_NGINX_CACHE_DIR__ under
data_dir/var/run and data_dir/var/cache/nginx, with legacy pid path patched
at apply. Consolidate runtimeuser path helpers into the main package file so
IDEs resolve references across build tags.

Makefile

@@ -40,7 +40,6 @@ build-backend:
 
 build-agent:
 	@echo "==> Building agent version=$(VERSION)..."
-	bash scripts/fetch-agent-geoip-mmdb.sh
 	go build \
 		-ldflags "-s -w -X '$(MODULE)/internal/apps/agent/config.Version=$(VERSION)'" \
 		-o bin/openflare-agent \