fix(env): one login-shell-derived PATH for every spawned tool (T-439)

Desktop/dock-launched clide inherits a sparse PATH (no ~/.local/bin, brew,
nvm, …), so pql/git/claude and PTY tools went missing. T-347 fixed only the
toolchain/pql path on Linux; env.dart's expander was still macOS-only and
claude/PTY/git used the raw PATH — the breakage recurred per spawn site
because there were three divergent expanders.

Consolidate into one resolver (lib/src/env/shell_env.dart):
- primeLoginShellPath(): probe the user's real login shell once at startup
  (`$SHELL -l -c`, sentinel-framed, bounded timeout, graceful fallback to the
  process PATH). Captures the user's actual PATH, not a hardcoded guess.
- expandToolPath(): the canonical merge (moved from toolchain_paths, which
  re-exports it for its tests) — unions the well-known user/local bin dirs.
- resolvedToolPath(): currentSearchPath() + expandToolPath, the single call
  every spawn site uses.

Routed through it: PTY children (registry.dart now overrides PATH), git
(env.dart → operations.dart), the toolchain probe (toolchain_paths), and
hosted claude (agent_bootstrap). Primed in main.dart's !kIsWeb boot. Deleted
the macOS-only env.dart copy and the cli_install copy.

Tests: new shell_env_test (probe + every fallback + merge); env_test and
cli_install_test updated to the consolidated surface. analyze clean, web wasm
build still green, make test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/main.dart

@@ -51,6 +51,7 @@ import 'package:clide/src/daemon/search_commands.dart';
 import 'package:clide/src/editor/registry.dart' show EditorRegistry;
 import 'package:clide/src/git/client.dart';
 import 'package:clide/src/cli/argv_dispatch.dart';
+import 'package:clide/src/env/shell_env.dart' show primeLoginShellPath;
 import 'package:clide/src/ipc/envelope.dart';
 import 'package:clide/src/ipc/mcp_server.dart';
 import 'package:clide/src/ipc/paths.dart' show workspaceSocketPath, logDirectory;
@@ -100,6 +101,11 @@ Future<void> main() async {
   LogLevel bootLogLevel = kReleaseMode ? LogLevel.warn : LogLevel.info;
   List<LogSink> bootLogSinks = const [];
   if (!kIsWeb) {
+    // Resolve the user's real login-shell PATH once, before any tool resolution
+    // or spawn — a desktop/dock launch inherits a sparse PATH that misses
+    // ~/.local/bin, brew, nvm, etc. (T-439). Bounded + graceful: a slow/failed
+    // probe just falls back to the process PATH + well-known dirs.
+    await primeLoginShellPath();
     final bootSettings = SettingsStore(appDir: appDir);
     await bootSettings.load();
     startupWorkRoot = resolveStartupWorkspace(