Change state.User to take a names.UserTag

There are a few other drive by changes:
 - bootstrap agent test also checks created environment
 - the logging from the apiserver permission test has some breaks in it (to visually separate the test output when it fails)
 - the user manager made me sad, we are looking at consistency of tags/names
 - adding a service no longer enforces that the user exists, however an envuser must exist (remote users will exist soon)
 - the UserTag returned from state.User instances is now explicitly a local user tag (rather than implicitly)
do we not still need this, in case the user is removed concurrently?