`pmg setup doctor` reported npm protection as OK on a machine with no npm
installed. Two compounding defects:
1. The availability gate used a plain `exec.LookPath`, which resolves the PMG
shim on PATH rather than the real binary, so the "skip" branch never fired.
It now uses `shim.ResolveRealBinary` (PATH with shim dirs stripped), matching
the runner, so a missing real binary correctly yields WARN "not available".
2. The result was inferred purely from a non-zero exit, so PackageManagerNotFound
(exit 127) and other failures were misread as a successful block. The check
now requires PMG's block headline in the captured output before reporting
PASS; other non-zero exits report WARN with the error surfaced.
The block headline is extracted into `ui.MalwareBlockedHeadline` so the doctor's
marker stays in sync with what PMG prints across its block-output sites.
