Give SSH commands the user-level tool paths (#6632)

* Give SSH commands the user-level tool paths

ssh host cmd runs neither a login nor an interactive shell, so on Arch it
gets the bare sshd PATH and can't find mise-managed tools like the agent
CLIs herdr scans for. Set PATH in the PAM environment (per-user via
@{HOME}), append the user-level dirs in env-bootstrap so login shells and
the uwsm session get them too, and source env-bootstrap before bashrc's
interactive guard for bash variants that read it non-interactively.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Don't let an empty PATH turn into a cwd entry

Appending with a bare "$PATH:" prefix leaves a leading colon when PATH
is unset, which shells treat as the current directory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

migrations/1786181929.sh

@@ -0,0 +1,13 @@
+echo "Give SSH commands the user-level tool paths via the PAM environment"
+
+# SSH commands (ssh host cmd) run without a login or interactive shell, so the
+# PAM environment is the only place they can inherit PATH from. Same line that
+# install/config/ssh-command-path.sh writes on fresh installs; skip if PATH is
+# already managed there (by us or by the user).
+grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf && exit 0
+
+sudo tee -a /etc/security/pam_env.conf >/dev/null <<'EOF'
+
+# Omarchy: give SSH commands and other non-shell logins the user-level tool paths
+PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
+EOF