fix: reject system binaries unreachable by other users; consistent info

The system-install validation checked the binary's own permissions and
the parent's tamper-safety but never reachability: a 0755 root-owned
binary under a 0700 directory (e.g. /root/pmg) passed every check while
every non-root user's shim failed with exit 127. Walk the directory
chain to / and require the search bit for others; doctor's system
binary check inherits this. E2E gains a reject case for a binary under
a non-searchable directory.

setup info: render alias/user-shim/system-shim rows through one
installed-state formatter (location when installed, "not installed"
otherwise) instead of a mix of booleans, paths, and prose.

.github/workflows/pmg-e2e.yml

@@ -927,6 +927,19 @@ jobs:
           fi
           echo "SUCCESS: user-owned binary rejected"
 
+      - name: Reject unreachable PMG binary for system install
+        run: |
+          # Binary is 0755 and root-owned, but sits under a 0700 dir: other
+          # users cannot traverse to it, so every shim would exit 127.
+          sudo mkdir -p /root/pmg-unreachable
+          sudo install -m 755 bin/pmg /root/pmg-unreachable/pmg
+          sudo chmod 700 /root/pmg-unreachable
+          if sudo /root/pmg-unreachable/pmg setup install --system; then
+            echo "ERROR: system install accepted a binary under a non-searchable directory"
+            exit 1
+          fi
+          echo "SUCCESS: unreachable binary rejected"
+
       - name: Install PMG system-wide
         run: |
           # GitHub runners ship /usr/local/bin world-writable; system install