ci: pin XDG_CONFIG_HOME for the cross-user e2e step; terse doctor fix

GitHub runners export XDG_CONFIG_HOME=/home/runner/.config and it leaks
through sudo -u, so the pmgtest pmg resolved the runner user's config
dir and fail-closed on its runner-owned log file (run 29289868727 shows
the triaged error catching exactly this). Set it inside the login shell
so it wins regardless of how the leak is delivered.

The remedy now returns a full-help and doctor-table pair from a single
triage, and drops the do-not-chown tail from the leak message.

cmd/setup/doctor.go

@@ -285,10 +285,11 @@ func checkEventLogDirResult(skipEventLogging bool, logDir, configDir string) doc
 
 	probe, err := os.CreateTemp(logDir, ".pmg-doctor-*")
 	if err != nil {
+		_, fix := config.UnwritableConfigDirRemedy(configDir)
 		return doctor.CheckResult{
 			Status:  doctor.StatusFail,
 			Message: "Event log directory not writable",
-			Fix:     config.UnwritableConfigDirRemedy(configDir),
+			Fix:     fix,
 		}
 	}
 	if err := probe.Close(); err != nil {

cmd/setup/doctor_test.go

@@ -147,6 +147,7 @@ func TestCheckEventLogDirResult(t *testing.T) {
 		result := checkEventLogDirResult(false, dir, configDir)
 		assert.Equal(t, doctor.StatusFail, result.Status)
 		assert.Equal(t, "Event log directory not writable", result.Message)
-		assert.Equal(t, config.UnwritableConfigDirRemedy(configDir), result.Fix)
+		_, expectedFix := config.UnwritableConfigDirRemedy(configDir)
+		assert.Equal(t, expectedFix, result.Fix)
 	})
 }