feat(config): derive runtime storage from Push home

[owainlewis]

Summary

• Add one typed PushPaths owner for config, state, history, audit, job locks, Slack inbox, and cache paths.
• Resolve defaults from PUSH_HOME, preserve explicit runtime path overrides, and keep assistant_root outside the protected runtime boundary.
• Update CLI precedence, service examples, installation, security, compatibility, and recovery documentation.

Why

Push runtime storage was reconstructed across modules and tied to ~/.push. A single root makes installations predictable and permits isolated homes without moving the user-owned assistant repository.

Test plan

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked (384 tests passed)
• mkdocs build --strict
• Independent final diff review approved with no remaining findings
• GitHub Actions passed: documentation, Ubuntu, and macOS

Risks

Explicit state_path, database_path, audit_log_path, and jobs_run_dir remain supported through the documented 0.x compatibility period. Unsafe assistant overlap now fails closed, including implicit legacy and symlinked Push home layouts.

Related issue

Closes #165