fix: reject system binaries unreachable by other users; consistent info

The system-install validation checked the binary's own permissions and
the parent's tamper-safety but never reachability: a 0755 root-owned
binary under a 0700 directory (e.g. /root/pmg) passed every check while
every non-root user's shim failed with exit 127. Walk the directory
chain to / and require the search bit for others; doctor's system
binary check inherits this. E2E gains a reject case for a binary under
a non-searchable directory.

setup info: render alias/user-shim/system-shim rows through one
installed-state formatter (location when installed, "not installed"
otherwise) instead of a mix of booleans, paths, and prose.

internal/shim/system_test.go

@@ -204,6 +204,28 @@ func TestParseShimPMGBinRoundTripsShellQuote(t *testing.T) {
 	}
 }
 
+func TestRequirePathSearchableByAll(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("unix permission semantics")
+	}
+
+	t.Run("standard system path passes", func(t *testing.T) {
+		// Only directories are inspected, so the file itself need not exist.
+		assert.NoError(t, requirePathSearchableByAll("/usr/bin/pmg-does-not-exist"))
+	})
+
+	t.Run("non-searchable ancestor rejects", func(t *testing.T) {
+		base := t.TempDir()
+		require.NoError(t, os.Chmod(base, 0o700))
+		sub := filepath.Join(base, "sub")
+		require.NoError(t, os.MkdirAll(sub, 0o755))
+
+		err := requirePathSearchableByAll(filepath.Join(sub, "pmg"))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "not searchable by all users")
+	})
+}
+
 func TestNewSystemShimManagerForRemoveSkipsValidation(t *testing.T) {
 	root := t.TempDir()
 	useSystemPaths(t, root)