fix(host): derive template backup dir from config, drop hardcoded path (W2)

backup_template used a hardcoded _BACKUP_BASE_DIR=/var/lib/ci/backups; now derives <config.paths.root>/backups (matches the CLI --backup-base-dir default) per the plan's no-hardcoded-path gotcha. Tests no longer need to monkeypatch the constant.

src/ci_orchestrator/operations/host.py

@@ -10,8 +10,8 @@ every ``systemctl`` invocation is an argument list, read-only.
 
 ``backup_template`` reuses the archive-step shape from
 ``commands/template.py::template_backup`` (timestamped ``7z`` archive under
-``/var/lib/ci/backups``) but is a fresh, click-free implementation so this
-module has no dependency on the CLI layer.
+``<config.paths.root>/backups``) but is a fresh, click-free implementation so
+this module has no dependency on the CLI layer.
 """
 
 from __future__ import annotations
@@ -27,7 +27,6 @@ if TYPE_CHECKING:  # pragma: no cover
     from ci_orchestrator.config import Config
 
 _SYSTEMCTL_TIMEOUT = 10.0
-_BACKUP_BASE_DIR = Path("/var/lib/ci/backups")
 
 
 @dataclass(frozen=True)
@@ -141,14 +140,17 @@ def backup_template(config: Config, template: str, *, dry_run: bool = False) ->
             error=f"Template directory not found: {tmpl_dir}",
         )
 
+    # Backup dir is config-driven (mirrors the CLI's --backup-base-dir default
+    # of <root>/backups); no hardcoded host path.
+    backup_base = config.paths.root / "backups"
     timestamp = datetime.now(tz=UTC).strftime("%Y%m%d_%H%M%S")
-    archive_path = _BACKUP_BASE_DIR / f"Template_{template}_{timestamp}.7z"
+    archive_path = backup_base / f"Template_{template}_{timestamp}.7z"
 
     if dry_run:
         return BackupResult(template=template, archive_path=archive_path, ok=True, error=None)
 
     try:
-        _BACKUP_BASE_DIR.mkdir(parents=True, exist_ok=True)
+        backup_base.mkdir(parents=True, exist_ok=True)
         _compress_7z(tmpl_dir, archive_path)
     except (OSError, subprocess.CalledProcessError) as exc:
         return BackupResult(template=template, archive_path=None, ok=False, error=str(exc))