fix: harden system-install review findings

Require root-owned, non-group/other-writable pmg for --system install;
allow remove without that validation. Doctor checks npm resolution for
PATH precedence, uses ImpliesInterception instead of message matching,
and documents version-manager shadowing. Pass profile bin dir from the
shim manager and note that system config ignores per-user files.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/setup/setup_test.go

@@ -15,7 +15,7 @@ func TestErrIfSystemInstallAllowed(t *testing.T) {
 	t.Cleanup(func() { setupGeteuid = orig })
 
 	setupGeteuid = func() int { return 0 }
-	err := errIfSystemInstallAllowed()
+	err := requireSystemInstallSupported()
 	if runtime.GOOS == "linux" {
 		assert.NoError(t, err)
 	} else {
@@ -26,7 +26,7 @@ func TestErrIfSystemInstallAllowed(t *testing.T) {
 	}
 
 	setupGeteuid = func() int { return 1000 }
-	err = errIfSystemInstallAllowed()
+	err = requireSystemInstallSupported()
 	require.Error(t, err)
 	usefulErr, ok := usefulerror.AsUsefulError(err)
 	require.True(t, ok)