fix: harden and simplify Linux system install

Tighten shim detection, profile repair, and install ordering while
trimming over-specific doctor/info hints from the system-install path.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/shim/system.go

@@ -15,9 +15,8 @@ const (
 	systemProfileMarker      = "PMG system shims"
 )
 
-// systemBinDirOverride and systemProfilePathOverride replace the OS-level
-// system install paths. They exist only for tests within this package. There
-// is intentionally no env var or flag for them.
+// These overrides replace OS-level system install paths in tests. There is
+// intentionally no env var or flag for them.
 var (
 	systemBinDirOverride      string
 	systemProfilePathOverride string
@@ -48,6 +47,10 @@ func NewSystemShimManager() (*ShimManager, error) {
 		return nil, err
 	}
 
+	if err := validateSystemExecutable(pmgBin); err != nil {
+		return nil, err
+	}
+
 	return &ShimManager{
 		config: ShimConfig{
 			BinDir:          SystemBinDir(),
@@ -59,6 +62,19 @@ func NewSystemShimManager() (*ShimManager, error) {
 	}, nil
 }
 
+// validateSystemExecutable rejects binaries other users cannot execute. System shims hard-code this path.
+func validateSystemExecutable(path string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("failed to inspect pmg executable %s: %w", path, err)
+	}
+
+	if info.Mode().Perm()&0o001 == 0 {
+		return fmt.Errorf("pmg executable %s is not executable by all users", path)
+	}
+	return nil
+}
+
 // SystemShimsInstalled reports whether the system shim directory contains at
 // least one shim script.
 func SystemShimsInstalled() bool {
@@ -71,7 +87,11 @@ func shimsPresent(dir string) bool {
 		return false
 	}
 	for _, e := range entries {
-		if !e.IsDir() {
+		if e.IsDir() {
+			continue
+		}
+		content, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err == nil && strings.Contains(string(content), shimScriptMarker) {
 			return true
 		}
 	}
@@ -91,19 +111,25 @@ func SystemProfileInstalled() bool {
 func writeSystemProfile() error {
 	binDir := SystemBinDir()
 	path := SystemProfilePath()
+
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("failed to create profile.d directory: %w", err)
 	}
 
-	if data, err := os.ReadFile(path); err == nil && strings.Contains(string(data), systemProfileMarker) {
-		return nil
-	}
-
 	content := fmt.Sprintf(`# %s - managed by pmg setup install --system
 # remove by running: pmg setup remove --system
 export PATH="%s:$PATH"
 `, systemProfileMarker, binDir)
 
+	data, err := os.ReadFile(path)
+	if err == nil && string(data) == content {
+		return nil
+	}
+
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to read system profile %s: %w", path, err)
+	}
+
 	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
 		return fmt.Errorf("failed to write system profile %s: %w", path, err)
 	}