bakery: add system prefix installs for BOS

Default remains ~/.local. Setting prefix=/usr/local (via
/etc/bakery/config.toml or BAKERY_PREFIX) installs bins and share
under that prefix and systemd user units under /usr/lib/systemd/user.
Writes that need root use sudo -n, then pkexec. State stays per-user.

bakery/src/state.rs

@@ -56,8 +56,7 @@ impl State {
     pub fn save(&self) -> Result<()> {
         let path = state_path();
         let text = serde_json::to_string_pretty(self)?;
-        bread_utils::atomic::write_atomic(&path, &text, None)
-            .context("writing installed.json")
+        bread_utils::atomic::write_atomic(&path, &text, None).context("writing installed.json")
     }
 
     /// Runs `f` against a freshly-loaded `State` while holding an exclusive
@@ -114,7 +113,13 @@ fn state_base_dir() -> PathBuf {
 }
 
 fn state_path() -> PathBuf {
-    state_base_dir().join("bakery/installed.json")
+    bakery_state_dir().join("installed.json")
+}
+
+/// Per-user bakery state dir (`~/.local/state/bakery`). Independent of the
+/// install prefix — system-prefix installs still record what this user asked for.
+pub fn bakery_state_dir() -> PathBuf {
+    state_base_dir().join("bakery")
 }
 
 /// Local backup dir for `pkg_name`'s `version` binaries, populated by
@@ -205,7 +210,10 @@ mod tests {
         assert_eq!(restored.packages["bar"].version, "2.0.0");
         assert_eq!(restored.packages["bar"].services, ["bar.service"]);
         assert_eq!(restored.packages["bar"].track, Track::Beta);
-        assert_eq!(restored.packages["bar"].previous_version.as_deref(), Some("1.0.0"));
+        assert_eq!(
+            restored.packages["bar"].previous_version.as_deref(),
+            Some("1.0.0")
+        );
         assert_eq!(restored.packages["bar"].binary_sha256["bar"], "abc123");
     }
 
@@ -228,6 +236,14 @@ mod tests {
         assert!(installed.binary_sha256.is_empty());
     }
 
+    #[test]
+    fn bakery_state_dir_is_under_state_home_and_independent_of_prefix() {
+        let dir = bakery_state_dir();
+        assert!(dir.ends_with("bakery"));
+        // Must not follow BAKERY_PREFIX — state is always per-user.
+        assert!(!dir.starts_with("/usr/local"));
+    }
+
     #[test]
     fn backup_dir_is_distinct_per_package_and_version() {
         let a = backup_dir("bakery", "0.3.1");