Protect Linux runtime checkout

[Pigbibi]

Summary

• prevent Linux bootstrap from installing the bot checkout inside configured project roots
• document durable VPS install path under ~/.telegram-codex-bot/app
• add bootstrap tests for unsafe and safe checkout layouts

Validation

• bash -n scripts/bootstrap-linux.sh
• uv run pytest tests/telegram_codex_bot/test_bootstrap_linux.py tests/telegram_codex_bot/test_hook.py
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/
• uv run pyright src/telegram_codex_bot/
• uv run pytest --tb=short -q