fix(doctor): stop npm protection passing when the real package manager is absent (#378)

`pmg setup doctor` reported npm protection as OK on a machine with no npm
installed. Two compounding defects:

1. The availability gate used a plain `exec.LookPath`, which resolves the PMG
   shim on PATH rather than the real binary, so the "skip" branch never fired.
   It now uses `shim.ResolveRealBinary` (PATH with shim dirs stripped), matching
   the runner, so a missing real binary correctly yields WARN "not available".

2. The result was inferred purely from a non-zero exit, so PackageManagerNotFound
   (exit 127) and other failures were misread as a successful block. The check
   now requires PMG's block headline in the captured output before reporting
   PASS; other non-zero exits report WARN with the error surfaced.

The block headline is extracted into `ui.MalwareBlockedHeadline` so the doctor's
marker stays in sync with what PMG prints across its block-output sites.

internal/ui/report.go

@@ -139,13 +139,19 @@ func Report(data *ReportData) {
 	}
 }
 
+// MalwareBlockedHeadline is the headline printed when a malicious package is
+// blocked. Exported so out-of-process consumers (e.g. `pmg setup doctor`) can
+// detect a genuine block from captured output instead of inferring it from a
+// non-zero exit code, which any failure would also produce.
+const MalwareBlockedHeadline = "Malicious package blocked"
+
 func printMalwareBlockSection(data *ReportData) {
 	if len(data.BlockedPackages) == 0 {
 		return
 	}
 
 	fmt.Println()
-	fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red("Malicious package blocked"))
+	fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red(MalwareBlockedHeadline))
 	printMaliciousPackagesList(data.BlockedPackages)
 	fmt.Println()
 }