fix(doctor): stop npm protection passing when the real package manager is absent (#378)

`pmg setup doctor` reported npm protection as OK on a machine with no npm
installed. Two compounding defects:

1. The availability gate used a plain `exec.LookPath`, which resolves the PMG
   shim on PATH rather than the real binary, so the "skip" branch never fired.
   It now uses `shim.ResolveRealBinary` (PATH with shim dirs stripped), matching
   the runner, so a missing real binary correctly yields WARN "not available".

2. The result was inferred purely from a non-zero exit, so PackageManagerNotFound
   (exit 127) and other failures were misread as a successful block. The check
   now requires PMG's block headline in the captured output before reporting
   PASS; other non-zero exits report WARN with the error surfaced.

The block headline is extracted into `ui.MalwareBlockedHeadline` so the doctor's
marker stays in sync with what PMG prints across its block-output sites.

internal/ui/ui.go

@@ -70,7 +70,7 @@ func blockWithExit(config *BlockConfig, exit bool) error {
 	// already shown to the user in verbose mode as part of the reporting.
 	if verbosityLevel != VerbosityLevelVerbose {
 		fmt.Println()
-		fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red("Malicious package blocked"))
+		fmt.Printf("%s %s\n", Colors.Red("✗"), Colors.Red(MalwareBlockedHeadline))
 
 		if config.ShowReference {
 			printMaliciousPackagesList(config.MalwarePackages)