Shell launch scripts: gate any directory you prepend to PATH, and test PATH in a macOS zsh -l via `command -v`, not the PATH prefix

Putting $HOME/.local/share/app/bin first on PATH after only a [ -x tool ] test is a PATH hijack: anyone who can write any parent (a umask 002 login makes ~/.local 775, or an ACL entry, or a g+w HOME) can plant ls. Fix: install the tool in a chain you create yourself under umask 077 directly below HOME, then prepend it only if a strict check passes for the file and every parent up to HOME: owned by the user, not a symlink, no group or other write (find P -prune \( -type l -o -perm -020 -o -perm -002 -o ! -user UID \)). Also skip the install when the top directory is a symlink. Testing gotcha: in a macOS zsh -l, /etc/zprofile runs path_helper, which moves system paths to the front, so asserting that PATH starts with your dir fails spuriously. Assert command -v tool instead, or that the dir is absent from PATH. Also: a POSIX sh function that calls set -- only changes the function's own positional parameters (dash too), so the caller's "$1" survives.