Give SSH commands the user-level tool paths (#6632)

* Give SSH commands the user-level tool paths

ssh host cmd runs neither a login nor an interactive shell, so on Arch it
gets the bare sshd PATH and can't find mise-managed tools like the agent
CLIs herdr scans for. Set PATH in the PAM environment (per-user via
@{HOME}), append the user-level dirs in env-bootstrap so login shells and
the uwsm session get them too, and source env-bootstrap before bashrc's
interactive guard for bash variants that read it non-interactively.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Don't let an empty PATH turn into a cwd entry

Appending with a bare "$PATH:" prefix leaves a leading colon when PATH
is unset, which shells treat as the current directory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

install/config/all.sh

@@ -2,6 +2,7 @@ run_logged "$OMARCHY_INSTALL/config/theme-system.sh"
 run_logged "$OMARCHY_INSTALL/config/increase-lockout-limit.sh"
 run_logged "$OMARCHY_INSTALL/config/lockscreen-pam.sh"
 run_logged "$OMARCHY_INSTALL/config/fix-powerprofilesctl-shebang.sh"
+run_logged "$OMARCHY_INSTALL/config/ssh-command-path.sh"
 run_logged "$OMARCHY_INSTALL/config/docker.sh"
 run_logged "$OMARCHY_INSTALL/config/snapper.sh"
 run_logged "$OMARCHY_INSTALL/config/locate.sh"

install/config/ssh-command-path.sh

@@ -0,0 +1,12 @@
+# SSH commands (ssh host cmd) run without a login or interactive shell, so on
+# Arch the PAM environment is the only place they can inherit PATH from. Add
+# the user-level tool paths there so remote tools (herdr, editors, agent CLIs)
+# find mise-managed installs. @{HOME} expands per-user from passwd. Keep the
+# directories in sync with default/bash/env-bootstrap.
+if ! grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf; then
+  cat >>/etc/security/pam_env.conf <<'EOF'
+
+# Omarchy: give SSH commands and other non-shell logins the user-level tool paths
+PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
+EOF
+fi