fix(env): one login-shell-derived PATH for every spawned tool (T-439)

Desktop/dock-launched clide inherits a sparse PATH (no ~/.local/bin, brew,
nvm, …), so pql/git/claude and PTY tools went missing. T-347 fixed only the
toolchain/pql path on Linux; env.dart's expander was still macOS-only and
claude/PTY/git used the raw PATH — the breakage recurred per spawn site
because there were three divergent expanders.

Consolidate into one resolver (lib/src/env/shell_env.dart):
- primeLoginShellPath(): probe the user's real login shell once at startup
  (`$SHELL -l -c`, sentinel-framed, bounded timeout, graceful fallback to the
  process PATH). Captures the user's actual PATH, not a hardcoded guess.
- expandToolPath(): the canonical merge (moved from toolchain_paths, which
  re-exports it for its tests) — unions the well-known user/local bin dirs.
- resolvedToolPath(): currentSearchPath() + expandToolPath, the single call
  every spawn site uses.

Routed through it: PTY children (registry.dart now overrides PATH), git
(env.dart → operations.dart), the toolchain probe (toolchain_paths), and
hosted claude (agent_bootstrap). Primed in main.dart's !kIsWeb boot. Deleted
the macOS-only env.dart copy and the cli_install copy.

Tests: new shell_env_test (probe + every fallback + merge); env_test and
cli_install_test updated to the consolidated surface. analyze clean, web wasm
build still green, make test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/kernel/src/cli_install.dart

@@ -14,6 +14,8 @@ library;
 
 import 'dart:io';
 
+import 'package:clide/src/env/shell_env.dart' show expandToolPath;
+
 /// State of the `clide` shell command relative to the running GUI.
 enum CliInstallState {
   /// No `clide` resolves on PATH.
@@ -209,7 +211,7 @@ class CliInstaller {
 
   static String get _pathSep => Platform.isWindows ? ';' : ':';
 
-  String _expandedPath() => expandedPath(env['PATH'] ?? '', macOS: Platform.isMacOS, home: env['HOME'] ?? '');
+  String _expandedPath() => expandToolPath(env['PATH'] ?? '', isMac: Platform.isMacOS, isLinux: Platform.isLinux, home: env['HOME'] ?? '');
 
   /// `~/.local/bin` on every platform — on Windows that is
   /// `%USERPROFILE%\.local\bin`, the same convention the claude and
@@ -234,16 +236,3 @@ final RegExp _devTreeClient = RegExp(r'(^|/)native/(linux|macos|windows)-(x64|ar
 /// PATH; it's a working client but not a packaged production install, so it's
 /// classified separately (T-256) rather than as a clean install.
 bool isDevTreeClient(String path) => _devTreeClient.hasMatch(path.replaceAll('\\', '/'));
-
-/// Expand a `PATH` value. Mirrors `toolchain_paths.dart`: macOS GUI apps
-/// launch with a sparse PATH that omits the usual user/homebrew bins, so on
-/// macOS we prepend those (de-duplicated) before scanning. A top-level,
-/// platform-parameterized function so both branches are testable off-platform.
-String expandedPath(String base, {required bool macOS, String home = ''}) {
-  if (!macOS) return base;
-  final extras = <String>[if (home.isNotEmpty) '$home/.local/bin', '/opt/homebrew/bin', '/opt/homebrew/sbin', '/usr/local/bin'];
-  final existing = base.split(':').toSet();
-  final missing = extras.where((p) => !existing.contains(p));
-  if (missing.isEmpty) return base;
-  return [...missing, ...existing].join(':');
-}