Extract shared engine/pai-paths.ts to dedupe migrator helpers

[virtualian]

Summary

• Closes Extract shared engine/pai-paths.ts: deduplicate getPaiHomeDir + cpFilter across three migrators (#160 follow-up) #162.
• New engine/pai-paths.ts exports getPaiHome / getPaiSkillsDir / getPaiCommandsDir resolvers, an isJunkEntry(name, opts) predicate, and a makeCpFilter(opts) factory.
• Each call site passes options that reproduce its prior local behaviour exactly:
  • skill-migration.ts: isJunkEntry(name) (default — backup-suffix is junk)
  • command-migration.ts: isJunkEntry(name, { extraEntries: COMMAND_EXTRA_JUNK }) (.gitkeep extension)
  • pai-runtime-migration.ts: makeCpFilter({ allowBackups: true }) (no backup-suffix matching, matching its prior local isIgnored)
  • actions.ts: getPaiHome() (replaces a 4th inlined copy that silently dropped the $HOME... prefix branch — latent bug closed as a side-benefit; surfaced by /simplify Reuse agent during review and approved as in-scope)
• Diff: −127 / +142 across 5 files; net behaviour-preserving dedup with one incidental bug fix.

Out-of-scope follow-ups (not addressed here)

The /simplify review surfaced further duplication worth filing as separate issues:

• migratePack ↔ migrateCommand 80-line state machines (drift backup → renameSync+EXDEV/ENOTEMPTY fallback → symlinkSync rollback) — near-byte-identical
• Backup-timestamp formatter new Date().toISOString().replace(/[:.]/g, "-") duplicated in skill-migration.ts:154 and command-migration.ts:148; lives next to BACKUP_SUFFIX_RE semantically
• classifySkillDir ↔ classifyCommandFile parallel structure
• memory-migration.ts:88-94 IGNORED_BASENAMES + isIgnoredName could fold into isJunkEntry({ extraEntries, allowBackups: true })

Test plan

• `bun test engine/skill-migration.test.ts engine/memory-migration.test.ts` from `Releases/v4.0.3+/.claude/PAI-Install/` — 25 pass / 0 fail / 84 expect() calls
• grep for `homedir`, `IGNORED_ENTRIES`, `BACKUP_SUFFIX_RE`, local `isIgnored`, local resolvers across the four migration modules — no inlined copies remain
• Public exports preserved: `migratePerPackSymlinks`, `classifySkillDir`, `migratePerPackCommands`, `classifyCommandFile`, `migratePaiRuntime`, plus `__testInternals` shape on `skill-migration.ts`
• `Tools/verify-security-validator.sh` — runtime-level test against `~/.pai/`; only meaningful after a fresh install. Not gating this PR.