fix: gate SUDO_USER trust and root path diversion; add doctor binary check

Address review findings on the system-install PR:

- cloud_sink: honor SUDO_USER for audit attribution only when euid==0.
  Without the gate any user could set SUDO_USER and spoof cloud-audit
  attribution to another account. Matches the guard in cmd/setup/cert.go.

- config: divert per-user paths to root's passwd home only on an actual
  sudo elevation (euid==0 && SUDO_USER set), not for every root euid.
  The blanket root diversion ignored HOME/XDG_CONFIG_HOME and silently
  stopped reading genuine root users' config (golden Docker images),
  regressing two tests that only fail when the suite runs as root.
  Genuine root honors the environment as before; su without - leaves no
  marker and stays a documented, loud-failing residual.

- doctor: add a system-only check re-validating that the binary the
  installed shims exec is still root-owned and non-writable, catching
  permission/ownership drift after install.

- shim: fold the duplicated shim-scan loop into firstShimContent.

cmd/setup/doctor_test.go

@@ -107,6 +107,17 @@ func TestClassifyPackageManagerResolutionsAcceptsEitherShimDir(t *testing.T) {
 	assert.Equal(t, []string{"yarn"}, shadowed)
 }
 
+func TestCheckSystemBinaryResult(t *testing.T) {
+	// No system shims installed -> could not determine binary (Warn).
+	result := checkSystemBinaryResult()
+	// On a dev machine with no /usr/local/lib/pmg/bin shims, SystemShimBinary
+	// returns !ok, so we get a Warn rather than a spurious Fail.
+	assert.Contains(t, []doctor.CheckStatus{doctor.StatusWarn, doctor.StatusPass, doctor.StatusFail}, result.Status)
+	if result.Status == doctor.StatusWarn {
+		assert.Equal(t, "Could not determine system shim binary", result.Message)
+	}
+}
+
 func TestCheckEventLogDirResult(t *testing.T) {
 	configDir := "/home/dev/.config/safedep/pmg"