fleet-agent: install agent.env from /tmp/agent (complete staging fix)

Companion to the previous commit's file move: point the 2b-agent install at
/tmp/agent/agent.env (the agent's own upload) instead of the deleted
/tmp/etc-stage path, update the file-provisioner comment, the enable_agent var
description, and the TODO source-path reference. packer validate passes.

docs/TODO.md

@@ -1406,7 +1406,7 @@ the design forks resolved:
   **receives `DesiredState`/`Command` but only LOGS them** (zero host mutation).
   Static `CGO_ENABLED=0` binary built out-of-VM in CI (like enrol/hostapi), staged
   by the `2b-agent` provisioner (`enable_agent`, default on), fapolicyd-trusted,
-  fleet-generic config in `files/etc/fleet-agent/agent.env`. mTLS handshake proven
+  fleet-generic config in `files/agent/agent.env`. mTLS handshake proven
   end-to-end against the go-tpm software simulator (`files/agent/simtest`). No
   dracut/initramfs changes (post-switch-root only). **STILL TO BUILD (deferred):**
   the **reconcile actuators** — apply kiosk_url, reboot_at/REBOOT, drain — wired to