fix(ocr): resolve HTRMOPO_DIR from env var, not ~ expansion

With --no-create-home, os.path.expanduser("~") resolves to "/" causing
kraken get to write to /.local/share/htrmopo. Replace with
os.environ.get("HTRMOPO_DIR", "/app/models/.htrmopo") so the path is
explicit and override-friendly without a home directory.

Adds two tests verifying env-var resolution and ~-free default.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ocr-service/test_ensure_blla_model.py

@@ -1,10 +1,35 @@
 """Unit tests for ensure_blla_model.main()."""
 
+import importlib
+import os
 from unittest.mock import MagicMock, call, patch
 
 import ensure_blla_model
 
 
+# ─── HTRMOPO_DIR env var resolution ──────────────────────────────────────────
+
+
+def test_htrmopo_dir_reads_from_env_var():
+    """HTRMOPO_DIR uses the HTRMOPO_DIR env var when set, not ~ expansion."""
+    with patch.dict(os.environ, {"HTRMOPO_DIR": "/custom/htrmopo"}):
+        importlib.reload(ensure_blla_model)
+        result = ensure_blla_model.HTRMOPO_DIR
+    importlib.reload(ensure_blla_model)
+    assert result == "/custom/htrmopo"
+
+
+def test_htrmopo_dir_default_is_fixed_path():
+    """Default HTRMOPO_DIR is a fixed path not derived from ~ (no-create-home safe)."""
+    clean_env = {k: v for k, v in os.environ.items() if k != "HTRMOPO_DIR"}
+    with patch.dict(os.environ, clean_env, clear=True):
+        importlib.reload(ensure_blla_model)
+        result = ensure_blla_model.HTRMOPO_DIR
+    importlib.reload(ensure_blla_model)
+    assert "~" not in result
+    assert not result.startswith("/.")
+
+
 # ─── Model already loadable ───────────────────────────────────────────────────