fix(terminal): complete sane PATH entries on POSIX (salvage of #35614)

[kshitijk4poor]

What does this PR do?

Salvages #35614 by @y0shua1ee and adds a hardening follow-up commit.

Fixes macOS gateway/launchd terminal sessions whose PATH already includes /usr/bin while omitting Apple Silicon Homebrew paths. LocalEnvironment._make_run_env() now appends each missing _SANE_PATH entry individually on POSIX, preserving caller precedence.

Root cause: the previous logic used /usr/bin as the sentinel for sane PATH injection. macOS launchd commonly provides /usr/bin while leaving out /opt/homebrew/bin and /opt/homebrew/sbin, so Homebrew-installed CLIs (gh, brew, xurl, node, …) stayed unavailable in terminal tool calls.

Fixes #35613.

Commits

1. fix(terminal): complete sane PATH entries on POSIX — @y0shua1ee's original fix from fix(terminal): complete sane PATH entries on POSIX #35614, cherry-picked unchanged (credited via Co-authored-by).
2. test(terminal): harden sane PATH completion against dup/empty entries — follow-up hardening (see below).

Hardening follow-up

Surfaced during review of #35614. Strengthens _append_missing_sane_path_entries:

• De-duplicate the caller PATH (first occurrence wins). The original fix only avoided introducing new duplicates from _SANE_PATH; a caller PATH that already contained duplicate entries was carried through verbatim.
• Drop empty PATH entries (leading/trailing/double :), which POSIX shells interpret as the current working directory — a mild foot-gun in a default terminal environment.

Behaviour for well-formed PATHs (no duplicates, no empty entries) is byte-identical to the original fix — verified by diffing output across the launchd, minimal, partial-sane, empty, and already-full cases. Only malformed/duplicated inputs change.

New regression tests:

• test_make_run_env_real_launchd_path_gains_homebrew — pins the literal macOS launchd PATH (/usr/bin:/bin:/usr/sbin:/sbin) as the production trigger.
• test_make_run_env_collapses_duplicate_caller_entries — dedup with first-occurrence order preserved.
• test_make_run_env_strips_empty_path_entries — empty-entry stripping.

The Windows path remains a no-op (_IS_WINDOWS early return); casing-key handling is unchanged.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

How to Test

PYTHONPATH=. python -m pytest \
  tests/tools/test_local_env_blocklist.py::TestSanePathIncludesHomebrew \
  tests/tools/test_windows_native_support.py::TestLocalEnvironmentPathInjectionGated \
  tests/tools/test_local_env_windows_msys.py \
  tests/test_subprocess_home_isolation.py \
  -o 'addopts=' -q

Result: 37 passed. Verified the new regression test goes RED against the pre-fix implementation with the documented AssertionError: assert '/opt/homebrew/bin' in ['/usr/local/bin', '/usr/bin', '/bin'].

Checklist

• Commit messages follow Conventional Commits
• Searched for existing PRs
• Added tests for the changes
• Tested on macOS
• Considered cross-platform impact (Windows path is a no-op)

[liuhao1024]

Verified clean. The _append_missing_sane_path_entries implementation correctly handles the three POSIX PATH footguns: empty entries (CWD injection via leading/trailing/double colons), duplicate entries (first-occurrence preserved), and missing sane directories (Homebrew etc. appended without overriding user precedence). The Windows guard is two-layered (early return in the helper + case-sensitive key resolution in _path_env_key), which is defensive and appropriate. Tests cover the literal macOS launchd PATH, empty-entry stripping, duplicate collapsing, and Windows passthrough — good edge-case coverage. LGTM.