Fix critical and high bugs B1-B6

- B1: Replace recursive get_timezone_mount/get_gpu_devices with literal YAML strings
- B3: Expand /home/*/hops glob via compgen -G instead of storing as array literal;
  fix eval echo ~$SUDO_USER -> getent passwd in uninstall
- B4: Correct services source path in setup_firewall (hops_service_definitions.sh -> services)
- B5: Replace all ((x++)) with x=$((x + 1)) to avoid set -e abort on zero pre-increment
- B6: Add Linux-only guard at top of hops entry point

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services

@@ -24,24 +24,18 @@ EOF
 # Get timezone mount path for current platform
 get_timezone_mount() {
     if [[ "$(uname -s)" == "Darwin" ]]; then
-        # macOS doesn't need timezone mount, use TZ environment variable
         echo ""
     else
-        # Linux timezone mount
-        echo "$(get_timezone_mount)"
+        echo "      - /etc/localtime:/etc/localtime:ro"
     fi
 }
 
 # Get GPU device access for current platform
 get_gpu_devices() {
     if [[ "$(uname -s)" == "Darwin" ]]; then
-        # macOS doesn't support GPU passthrough to Docker containers
         echo ""
     else
-        # Linux GPU device access
-        cat <<EOF
-$(get_gpu_devices)
-EOF
+        printf "    devices:\n      - /dev/dri:/dev/dri\n"
     fi
 }