fix: harden system-install review findings

Require root-owned, non-group/other-writable pmg for --system install;
allow remove without that validation. Doctor checks npm resolution for
PATH precedence, uses ImpliesInterception instead of message matching,
and documents version-manager shadowing. Pass profile bin dir from the
shim manager and note that system config ignores per-user files.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/shim/shim.go

@@ -82,7 +82,7 @@ func (m *ShimManager) Install() error {
 	}
 
 	if m.config.ManageProfile {
-		if err := writeSystemProfile(); err != nil {
+		if err := writeSystemProfile(m.config.BinDir); err != nil {
 			return fmt.Errorf("failed to write system profile: %w", err)
 		}
 	}