Split out agent launching from setup

Support reverse proxy setup (specify tunnel arg for jnlp launch,
keep traffic inside the VPC)

The agent part needs to re-run during recipe development.
The setup part is not idempotent, so avoid re-running it.