ci: add Linux system-install e2e and pin pnpm for add flake

Cover root system setup, PATH/profile.d, managed config, non-root
interception, and remove. Pin pnpm 11.10.0 on the package-manager e2e
job after an integrity crash on pnpm add.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/pmg-e2e.yml

@@ -49,6 +49,9 @@ jobs:
 
       - name: Setup PNPM
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
+        with:
+          # Unpinned pnpm 11.x hit an integrity crash on `pnpm add`
+          version: 11.10.0
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
@@ -874,3 +877,111 @@ jobs:
 
       - name: Run Package Manager E2E Test
         run: pmg --sandbox --sandbox-enforce npm exec -- node test/pm-e2e.js
+
+  # Linux system-wide install: root install, ENV PATH (Docker-style), non-root user,
+  # managed config, and remove. Profile.d login shells are covered by sourcing the snippet.
+  e2e-system-install:
+    name: PMG E2E - System Install (Linux)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+
+      - name: Build PMG
+        run: make
+
+      - name: Reject private PMG binary for system install
+        run: |
+          sudo mkdir -p /root/pmg-private
+          sudo cp bin/pmg /root/pmg-private/pmg
+          sudo chmod 700 /root/pmg-private /root/pmg-private/pmg
+          if sudo /root/pmg-private/pmg setup install --system; then
+            echo "ERROR: system install accepted a non-world-executable binary"
+            exit 1
+          fi
+          echo "SUCCESS: private binary rejected"
+
+      - name: Install PMG system-wide
+        run: |
+          sudo install -m 755 bin/pmg /usr/local/bin/pmg
+          sudo pmg setup install --system
+
+      - name: Verify system install artifacts
+        run: |
+          test -f /etc/safedep/pmg/config.yml
+          test -f /etc/profile.d/pmg.sh
+          grep -q '/usr/local/lib/pmg/bin' /etc/profile.d/pmg.sh
+          for shim in npm pip pip3 pipx pnpm bun uv uvx yarn poetry npx pnpx; do
+            test -x "/usr/local/lib/pmg/bin/$shim" || { echo "Missing shim: $shim"; exit 1; }
+          done
+
+      - name: PATH and profile.d activate shims
+        run: |
+          # Docker-style: non-login shells need PATH (or source profile.d)
+          export PATH="/usr/local/lib/pmg/bin:$PATH"
+          which npm | grep -q '/usr/local/lib/pmg/bin/npm'
+          source /etc/profile.d/pmg.sh
+          which npm | grep -q '/usr/local/lib/pmg/bin/npm'
+
+      - name: Managed config refuses CLI mutation
+        run: |
+          if pmg config set dependency_cooldown.days 7; then
+            echo "ERROR: config set should fail under system config"
+            exit 1
+          fi
+          if sudo pmg config set dependency_cooldown.days 7; then
+            echo "ERROR: config set should fail under system config even as root"
+            exit 1
+          fi
+          echo "SUCCESS: managed config is locked"
+
+      - name: Doctor reports system install state
+        run: |
+          export PATH="/usr/local/lib/pmg/bin:$PATH"
+          out=$(pmg setup doctor 2>&1 || true)
+          echo "$out"
+          echo "$out" | grep -q 'No aliases (system install)'
+          echo "$out" | grep -q 'System shim directory is in PATH'
+
+      - name: Non-root user interception via system shims
+        run: |
+          sudo useradd -m pmgtest || true
+          # Pass runner PATH so setup-node's npm remains visible after FilterPMGFromPath.
+          sudo -u pmgtest env "PATH=/usr/local/lib/pmg/bin:$PATH" HOME=/home/pmgtest bash -lc '
+            set -euo pipefail
+            which npm | grep -q /usr/local/lib/pmg/bin/npm
+            mkdir -p "$HOME/sys-e2e" && cd "$HOME/sys-e2e"
+            npm init -y
+            if npm install --no-cache --prefer-online safedep-test-pkg@0.1.3; then
+              echo "ERROR: safedep-test-pkg was not blocked for non-root user"
+              exit 1
+            fi
+            if [ -d node_modules/safedep-test-pkg ]; then
+              echo "ERROR: safedep-test-pkg present in node_modules"
+              exit 1
+            fi
+            echo "SUCCESS: non-root user blocked malicious package via system shims"
+          '
+
+      - name: Remove system install
+        run: |
+          sudo pmg setup remove --system --config-file
+          test ! -e /etc/profile.d/pmg.sh
+          test ! -e /etc/safedep/pmg/config.yml
+          test ! -d /usr/local/lib/pmg/bin
+          echo "SUCCESS: system install removed"