fix(preflight): address review on the batched PATH lookup

- Deduplicate candidates per command: 'tool' and 'tool.CMD' may resolve to
  the same on-disk file and both must still be found.
- Probe known candidate names directly when readdir is denied (EACCES/EPERM):
  an execute-only directory cannot be listed, but stat on known names works,
  which is what the per-candidate lookup did.
- Skip the install-dir fallback's PATH re-scan: the batch already proved the
  missed commands absent on the PATH it searched, and that PATH is a superset
  of the fallback's (merged persisted PATH on Windows, the same filtered PATH
  on a WSL host), so the fallback scans install directories only.

src/shared/node-cli-command-resolution.ts

@@ -9,6 +9,8 @@ type ResolveCommandOptions = {
   pathEnv?: string | null
   platform?: NodeJS.Platform
   homePath?: string
+  /** Skip the PATH scan; the caller already established absence there (agent detection batches it). */
+  skipPathSearch?: boolean
 }
 
 function getExecutableNames(platform: NodeJS.Platform, commandName: string): string[] {
@@ -288,7 +290,9 @@ export function resolveCliCommands(
 
   for (const commandName of new Set(commandNames)) {
     const executableNames = getExecutableNames(platform, commandName)
-    const pathCandidate = findFirstExecutable(platform, pathDirectories, executableNames)
+    const pathCandidate = options.skipPathSearch
+      ? undefined
+      : findFirstExecutable(platform, pathDirectories, executableNames)
     const installCandidate =
       pathCandidate ?? findFirstExecutable(platform, installDirectories, executableNames)
     resolved.set(commandName, installCandidate ?? commandName)