feat(export): also export /usr/sbin binaries

[CheapFuck]

What

towel export only exported executables under /usr/bin. Packages that install into /usr/sbin (the issue mentions nix) were silently skipped.

Two patterns hardcoded /usr/bin:

 function towel_repoquery_exportables() {
 	local pkg="$1"
-	local bins_regex='/usr/bin/\S+'
+	local bins_regex='/usr/s?bin/\S+'
 	local desktops_regex='/usr/share/applications/\S+\.desktop'

 	local bin_files
-	bin_files=$(grep -E '^/usr/bin/\S+$' <<<"$files") || true
+	bin_files=$(grep -E '^/usr/s?bin/\S+$' <<<"$files") || true

Both now match /usr/bin and /usr/sbin.

Why it's safe

• towel_export_bin_wrapper execs the binary by its full path (exec $bin_path), so an /usr/sbin target works with no other changes.
• The existing [ -e "$bin_file" ] guard still applies, so only files that actually exist are wrapped.
• /usr/bin matching is unchanged (the s? only adds /usr/sbin).

Verification (inside a towel container)

• New regex still matches real /usr/bin entries (dnf repoquery -l bash → /usr/bin/bash, …). No regression.
• New regex matches both /usr/bin/foo and /usr/sbin/bar; the old regex dropped /usr/sbin/bar.
• shellcheck -x and shfmt -d pass on install, towel, and all towel-* scripts.

Note: on a fully usr-merged image (e.g. Fedora rawhide, where /usr/sbin -> bin) repoquery already reports /usr/bin paths, so this is a no-op there; the change matters on systems/packages that still populate /usr/sbin.

Closes #14