fix: harden system-install review findings

Require root-owned, non-group/other-writable pmg for --system install;
allow remove without that validation. Doctor checks npm resolution for
PATH precedence, uses ImpliesInterception instead of message matching,
and documents version-manager shadowing. Pass profile bin dir from the
shim manager and note that system config ignores per-user files.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/doctor/doctor.go

@@ -9,10 +9,11 @@ const (
 )
 
 type CheckResult struct {
-	Name     string
-	Category string
-	Status   CheckStatus
-	Message  string
+	Name                string
+	Category            string
+	Status              CheckStatus
+	Message             string
+	ImpliesInterception bool
 }
 
 type Check struct {