feat(paseo)!: drop go and sdkman, rename AGENT_CLIS to AGENTS

The image installs python, gh, glab, build-essential, sudo, zsh and nano
only; go or a jvm goes into $HOME from a terminal instead.

SHELL and TZ are written into compose.yml rather than read from .env, so
the deploying shell's own values can no longer win over them.

The entrypoint calls chpasswd, chown and gosu by absolute path, tolerates
a chpasswd failure instead of taking the start down with it, turns
globbing off around the agent loop, and counts an agent as installed only
when its binary actually runs.

paseo/compose.yml

@@ -6,9 +6,9 @@ services:
       - PASEO_PASSWORD=${PASEO_PASSWORD}
       - PASEO_HOSTNAMES=${PASEO_HOSTNAMES}
       - PASEO_TRUSTED_PROXIES=${PASEO_TRUSTED_PROXIES}
-      - SHELL=${SHELL}
-      - AGENT_CLIS=${AGENT_CLIS}
-      - TZ=${TZ}
+      - SHELL=/bin/zsh
+      - AGENTS=${AGENTS}
+      - TZ=Asia/Ho_Chi_Minh
       - GIT_AUTHOR_NAME=${GIT_NAME}
       - GIT_AUTHOR_EMAIL=${GIT_EMAIL}
       - GIT_COMMITTER_NAME=${GIT_NAME}