One ops dir: AMICODE_OPS_DIR defaults disagree (~/.amico vs ~/.amico/amicode) #1998

Found in the hub live test of #1995. Two amicodeOpsDir() implementations (substrate/vault_store.ts and amicode_service/connections.ts) default to ~/.amico/amicode. model_reachability.ts, and the #864 routingSnapshotFile convention it copies, default to ~/.amico. So the picker config lives in ~/.amico/amicode/model-picker.json while its sibling cache is at ~/.amico/model-reachability.json. I hit this live: I wrote the config to the wrong one.

Fix: one exported amicodeOpsDir(), with every caller importing it. Migrate existing files by reading the legacy path when the new one is missing. Decide the canonical default; ~/.amico/amicode holds entitlements and onboarding today.

AC:

• grep -rn 'function amicodeOpsDir' returns one hit.
• A test shows the reachability cache and picker config resolve to the same dir under both an env override and the default.
• A legacy-path cache is still read.