feat(isolation): add per-user config overrides under user_configs directory

[oca-agent]

Summary of Changes

1. Git Ignore: Added user_configs/ to .gitignore to protect sensitive per-user environments.
2. Enhanced Configuration Parsing (src/config.py):
   • Added user_configs_dir (defaulting to "user_configs") and user_env_vars to the core Config dataclass.
   • Implemented load_user_config(linux_user, base_config) which loads .env overrides on demand for specific mapped users using dotenv.dotenv_values().
   • Casts and updates configuration types (strings, lists, booleans, and JSON variables like GOOSE_MCP_SERVERS).
3. Enhanced Goose Process Spawner (src/goose_acp_client.py):
   • Binds dynamic configurations to GooseACPClient based on user-specific overrides.
   • Merges and forwards all custom variables (like custom tools or provider API keys) through the sudo -n -u {linux_user} ... /usr/bin/env security boundary.
4. Command Line Boundary Matching Alignment (setup_user.sh & sudoers.template):
   • Updated template and provision instructions to run with the actual executing command /usr/bin/env * goose acp * instead of direct path, preventing production environment permission blockages.
5. Documentation (README.md):
   • Added a detailed "Per-User Config Overrides" setup and configuration guide.
6. Robust Tests (tests/):
   • Fixed pre-existing mock assumptions.
   • Added unit tests for config parser logic in test_config.py.
   • Added integration/spawner tests in test_goose_acp_client.py verifying environmental values merge and mapping down into subprocess executions.
   • Verified that all 142 tests pass cleanly.