fix: harden doctor PATH checks and attribute cloud events by OS user

Doctor now verifies every installed package manager against the shim
directory, and system-install validation only requires a safe parent
directory. Cloud sync records username/uid on invocation context for
multi-user hosts sharing one endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/audit/cloud_sink.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"os/user"
 	"strings"
 
 	controltowerv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/controltower/v1"
@@ -17,7 +18,7 @@ import (
 type cloudSink struct {
 	*SyncClientBundle
 	invocationID string
-	ciResolver  CloudSinkCIResolver
+	ciResolver   CloudSinkCIResolver
 	command      string
 	workingDir   string
 }
@@ -94,6 +95,12 @@ func (s *cloudSink) buildInvocationContext() *controltowerv1.EndpointInvocationC
 	ctx.SetCommand(s.command)
 	ctx.SetWorkingDirectory(s.workingDir)
 
+	u, err := user.Current()
+	if err == nil {
+		ctx.SetUsername(u.Username)
+		ctx.SetUsernameUid(u.Uid)
+	}
+
 	if s.ciResolver != nil {
 		ci := &controltowerv1.EndpointCIContext{}
 		ci.SetProvider(s.ciResolver.Provider())

internal/audit/cloud_sink_test.go

@@ -154,4 +154,6 @@ func TestCloudSinkSetsInvocationContextOnSessionComplete(t *testing.T) {
 	require.NotNil(t, invCtx, "session complete event must have invocation context")
 	assert.Contains(t, invCtx.GetCommand(), "npm")
 	assert.NotEmpty(t, invCtx.GetWorkingDirectory())
+	assert.NotEmpty(t, invCtx.GetUsername())
+	assert.NotEmpty(t, invCtx.GetUsernameUid())
 }