loader_opam: Improve manage opam shared state services

ExecStart does not support somewhat convoluted bash command, so wrap those in a
dedicated script installed in /usr/local/bin/ instead.

This clarifies the reading of the manifest and push the update logic within the
boundaries of the script in question.

Related to T3590