feat(paseo)!: drop go and sdkman, rename AGENT_CLIS to AGENTS

The image installs python, gh, glab, build-essential, sudo, zsh and nano
only; go or a jvm goes into $HOME from a terminal instead.

SHELL and TZ are written into compose.yml rather than read from .env, so
the deploying shell's own values can no longer win over them.

The entrypoint calls chpasswd, chown and gosu by absolute path, tolerates
a chpasswd failure instead of taking the start down with it, turns
globbing off around the agent loop, and counts an agent as installed only
when its binary actually runs.

paseo/.env.example

@@ -17,18 +17,11 @@ PASEO_HOSTNAMES=
 # `uniquelocal` covers the private ranges Docker bridge networks use.
 PASEO_TRUSTED_PROXIES=uniquelocal
 
-# Shell for Paseo's terminals. Paseo reads $SHELL and otherwise falls back to
-# /bin/sh (dash); it ignores the user's login shell, so `chsh` has no effect.
-SHELL=/bin/zsh
-
 # Agent CLIs to install on start, if not already present. Space- or
 # comma-separated, from: claude codex opencode copilot omp pi. Leave empty to
 # install none. The first start with a new paseo-home volume downloads a few
 # hundred MB per agent and takes a while; later starts only check.
-AGENT_CLIS=claude codex
-
-# Timezone for logs and agent shells.
-TZ=Asia/Ho_Chi_Minh
+AGENTS=claude codex
 
 # Git identity for agents and terminals, as author and committer. git reads
 # these directly, so no `git config` step is needed.