fix(host): derive template backup dir from config, drop hardcoded path (W2)

backup_template used a hardcoded _BACKUP_BASE_DIR=/var/lib/ci/backups; now derives <config.paths.root>/backups (matches the CLI --backup-base-dir default) per the plan's no-hardcoded-path gotcha. Tests no longer need to monkeypatch the constant.

tests/python/test_operations_host.py

@@ -203,7 +203,6 @@ def test_backup_template_dry_run_does_not_compress(monkeypatch: pytest.MonkeyPat
     tmpl_dir = templates / "WinBuild2025"
     tmpl_dir.mkdir(parents=True)
     config = _make_config(templates)
-    monkeypatch.setattr(host_module, "_BACKUP_BASE_DIR", tmp_path / "backups")
 
     calls: list[tuple[Path, Path]] = []
     monkeypatch.setattr(host_module, "_compress_7z", lambda src, dst: calls.append((src, dst)))
@@ -225,7 +224,6 @@ def test_backup_template_success_mocked_archive_step(
     tmpl_dir = templates / "WinBuild2025"
     tmpl_dir.mkdir(parents=True)
     config = _make_config(templates)
-    monkeypatch.setattr(host_module, "_BACKUP_BASE_DIR", tmp_path / "backups")
 
     def _fake_compress(src: Path, dst: Path) -> None:
         dst.parent.mkdir(parents=True, exist_ok=True)
@@ -249,7 +247,6 @@ def test_backup_template_archive_failure_reported(
     tmpl_dir = templates / "WinBuild2025"
     tmpl_dir.mkdir(parents=True)
     config = _make_config(templates)
-    monkeypatch.setattr(host_module, "_BACKUP_BASE_DIR", tmp_path / "backups")
 
     def _boom(_src: Path, _dst: Path) -> None:
         raise subprocess.CalledProcessError(1, ["7z"])
@@ -269,7 +266,6 @@ def test_backup_template_never_calls_real_vmrun_or_7z(monkeypatch: pytest.Monkey
     tmpl_dir = templates / "WinBuild2025"
     tmpl_dir.mkdir(parents=True)
     config = _make_config(templates)
-    monkeypatch.setattr(host_module, "_BACKUP_BASE_DIR", tmp_path / "backups")
 
     called: list[bool] = []