fix: critical bugs in agent identity provisioning [#442]

Email domain bug (would have caused all provisioning to fail):
- Cloudron email default was tsys-cloudron.knel.net (the dashboard host)
  instead of turnsys.com (the actual identity domain). Fixed in 3 places.
- Added explicit cloudron_email field to all agents in agents.yaml.example.

Other fixes:
- STATE_DIR.mkdir() moved from module level to main() so --dry-run and
  --help work outside the container.
- IndexError guard: password_inputs[0] crashes if zero fields found.
- State file save moved to finally block so partial results survive
  provisioning failures.
- Exception in provision_agent no longer re-raised (was preventing state
  file write and summary reporting).
- BW item_exists no longer swallows network/session errors as 'not found'
  (was causing duplicate credential creation).
- Redundant -u flag in bw generate (-uluns → -ulns).
- Dockerfile: npx install with || true → npm install -g (silent failure
  would cause runtime 'bw: command not found').
- Added .dockerignore to prevent .env/agents.yaml/state from entering image.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

agents.yaml.example

@@ -10,6 +10,7 @@
 agents:
   - name: vp-techops
     display_name: "VP TechOps"
+    cloudron_email: "vp-techops@turnsys.com"
     priority: Q3
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems:
@@ -28,6 +29,7 @@ agents:
 
   - name: vp-secops
     display_name: "VP SecOps"
+    cloudron_email: "vp-secops@turnsys.com"
     priority: Q3
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems:
@@ -46,6 +48,7 @@ agents:
 
   - name: vp-techcompliance
     display_name: "VP TechCompliance"
+    cloudron_email: "vp-techcompliance@turnsys.com"
     priority: Q3
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems:
@@ -65,18 +68,21 @@ agents:
   # Q4 agents — enroll in Cloudron only (Phase 1), no system access yet
   - name: coo
     display_name: "Chief Operating Officer"
+    cloudron_email: "coo@turnsys.com"
     priority: Q4
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems: {}
 
   - name: svp-knel
     display_name: "SVP KNEL"
+    cloudron_email: "svp-knel@turnsys.com"
     priority: Q4
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems: {}
 
   - name: svp-tctc
     display_name: "SVP TCTC"
+    cloudron_email: "svp-tctc@turnsys.com"
     priority: Q4
     cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
     systems: {}