Fix critical and high bugs B1-B6

- B1: Replace recursive get_timezone_mount/get_gpu_devices with literal YAML strings
- B3: Expand /home/*/hops glob via compgen -G instead of storing as array literal;
  fix eval echo ~$SUDO_USER -> getent passwd in uninstall
- B4: Correct services source path in setup_firewall (hops_service_definitions.sh -> services)
- B5: Replace all ((x++)) with x=$((x + 1)) to avoid set -e abort on zero pre-increment
- B6: Add Linux-only guard at top of hops entry point

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

install

@@ -333,7 +333,7 @@ EOF
                 return 0
             fi
             
-            ((attempt++))
+            attempt=$((attempt + 1))
         done
         
         # Fallback: construct a guaranteed compliant password
@@ -913,8 +913,8 @@ EOF
             fi
             
             # Allow service ports based on selection
-            if [[ -f "$SCRIPT_DIR/hops_service_definitions.sh" ]]; then
-                source "$SCRIPT_DIR/hops_service_definitions.sh"
+            if [[ -f "$SCRIPT_DIR/services" ]]; then
+                source "$SCRIPT_DIR/services"
                 
                 for svc in "${SERVICES[@]}"; do
                     local ports=$(get_service_ports "$svc")
@@ -1015,7 +1015,7 @@ EOF
             local main_port=$(echo $ports | cut -d' ' -f1)
             if [[ -n "$main_port" ]]; then
                 echo "   • $svc: http://$(get_primary_ip):$main_port"
-                ((service_count++))
+                service_count=$((service_count + 1))
             fi
         fi
     done