config: install varlock as agent user, not root

setup.sh was running 'curl | sh' as root, which installed varlock to
root's home. start.sh expects it at ~/.varlock/bin/varlock under the
agent user. Now runs the installer as baudbot_agent via sudo -u so
it lands in the right place.

Author: benvinegar

setup.sh

@@ -191,10 +191,13 @@ echo "=== Installing Slack bridge dependencies ==="
 (cd "$REPO_DIR/slack-bridge" && npm install)
 
 echo "=== Installing varlock ==="
-if command -v varlock &>/dev/null; then
-  echo "varlock already installed, skipping"
+# varlock must be available to the agent user (start.sh adds ~/.varlock/bin to PATH).
+# Install as agent user so it lands in the right home directory.
+AGENT_VARLOCK="$BAUDBOT_HOME/.varlock/bin/varlock"
+if [ -x "$AGENT_VARLOCK" ]; then
+  echo "varlock already installed for baudbot_agent, skipping"
 else
-  curl -sSfL https://varlock.dev/install.sh | sh -s
+  sudo -u baudbot_agent bash -c 'curl -sSfL https://varlock.dev/install.sh | sh -s'
 fi
 
 echo "=== Deploying from source to runtime ==="