fix: address system-install review findings

- shim: make system executable resolution injectable so tests pass under
  umask 002; skip the root-owner test when running as root
- doctor: treat resolution into either the system or per-user shim dir as
  intercepted, and collapse the shim-in-PATH check to a single call site
- setup: make remove (both --system and per-user) best-effort with
  errors.Join so one failed step no longer strands the other artifact
- shim: allow a group-writable install parent dir (Debian/Ubuntu ship
  /usr/local/bin as root:staff 2775) while still rejecting world-writable
  and non-root-owned parents
- audit: attribute cloud events to SUDO_USER when running under sudo
- docs: drop the soft-fail event-logging claim (hard-fail is retained)

internal/shim/shim.go

@@ -1,6 +1,7 @@
 package shim
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -99,25 +100,26 @@ func (m *ShimManager) Install() error {
 }
 
 func (m *ShimManager) Remove() error {
+	// Best-effort: a failure removing the shim directory must not skip profile
+	// and rc cleanup, otherwise a rerun is needed to fully uninstall.
+	var errs []error
 	if err := os.RemoveAll(m.config.BinDir); err != nil {
-		return fmt.Errorf("failed to remove shim directory %s: %w", m.config.BinDir, err)
+		errs = append(errs, fmt.Errorf("failed to remove shim directory %s: %w", m.config.BinDir, err))
 	}
 
 	if m.config.ManageProfile {
 		if err := removeSystemProfile(); err != nil {
-			return fmt.Errorf("failed to remove system profile: %w", err)
+			errs = append(errs, fmt.Errorf("failed to remove system profile: %w", err))
 		}
 	}
 
-	if m.config.SkipShellRc {
-		return nil
+	if !m.config.SkipShellRc {
+		if err := m.removePathFromShells(); err != nil {
+			errs = append(errs, fmt.Errorf("failed to clean shell configs: %w", err))
+		}
 	}
 
-	if err := m.removePathFromShells(); err != nil {
-		return fmt.Errorf("failed to clean shell configs: %w", err)
-	}
-
-	return nil
+	return errors.Join(errs...)
 }
 
 func (m *ShimManager) IsInstalled() (bool, error) {