refactor: split agent-service.ts into focused modules (#2622, #2626)

Extract buildAgentEnvironment (414 lines) into agent-environment.ts and
buildAgentVolumes (402 lines) into agent-volumes.ts. Agent-service.ts
retains buildAgentService + buildIptablesInitService with re-exports for
backwards compatibility.

Split matching test file into agent-environment.test.ts (1,025 lines),
agent-volumes.test.ts (617 lines), and agent-service.test.ts (411 lines).

All 127 tests pass. Build passes.

Closes #2622
Closes #2626

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox