Fix root symlink follow in postinst CLI-prefix

Found by Task 11259's security review (PR #7340), which made root never follow a link under $JAAH_HOME. `packaging/postinst` (configure, the agent-CLI install arm) runs `install -d -o jaah -g jaah -m 0755 "$jaah_user_home/.local" "$cli_path"` as root. Both paths are inside `jaah`'s home, which `jaah` owns, so `jaah` can plant a symlink at either one and request an upgrade. `install -d` then chowns and chmods the link's target as root. Ask: root never follows a link at those paths. Create them as `jaah` (`runuser -u jaah -- mkdir -p`), or use the `mkdir` + `chown -h` + chmod-as-owner pattern PR #7340 used for $JAAH_HOME. Out of scope: $JAAH_HOME (done in #7340) and /var/lib/jaahd (done in #7333). Done means: - A stub-PATH test (like `tools/tests/test_postinst_jaah_home_links.py`) plants a link at `.local` that points outside, runs the step, and shows the target unchanged and not chowned. - `./dc check quick` is green.

postinst now creates ~jaah/.local and .local/bin as jaah (runuser mkdir), never with root install -d. A stub-PATH test proves a planted link's target is left alone. Quick gate green; security review passed. PR #7346 is queued to the merge lane. Memory: none applied.