fix(orchestration): apply usb_passthrough default after sentinel replacement

The usb_passthrough default for the shared service was set in _setup_default_shared_or_device_service, which runs before _apply_default_environment. Mutating the sentinel's container (usb_passthrough None → True) broke the equality check that detects the sentinel, so the sentinel was never swapped out and sources={"orangeqs-juice-core": {"sentinel": True}} leaked into OrchestrationSettings.load().services["shared"].environment.

Moved the usb_passthrough defaulting into _apply_default_environment, where it now runs on the already-resolved environment.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Closes #373 (closed)