fix(utils): honor executable lookup overrides

[sj0618]

What

• Pass caller-provided PATH and cwd options through macOS executable discovery.
• Keep explicit empty lookup values distinct in the executable cache key.
• Avoid escaping an explicit PATH into hard-coded Xcode fallback directories.
• Add one regression covering override handling and the former cache-key collision.

Why

On macOS, $which ignored lookup overrides and could return an executable outside an explicitly constrained PATH. Cache keys could also collide when cwd and PATH contained the same string.

This supersedes #3656. The owner review on that PR found no P0/P1 and marked the implementation MERGE_READY with all 16 checks green; it was closed only because another PR merged first and made its exact sequential base stale. This successor is rebased directly onto current dev@0cc1536db0705154c5f0454e0b62694f29427a7a.

Testing

• bun test packages/utils/test/which.test.ts — 1 pass
• bun test packages/utils/test — 252 pass, 0 fail
• bun --cwd=packages/utils run check
• git diff --check upstream/dev...HEAD

GJC verdict

gajae.pr-review-verdict.v1 merge-approved sha256:caf2edf3ee8b5f1e901212a2b0194ba37045019c reviewer:critic evidence:local-exact-head-review

---

• Target branch is dev
• Relevant Bun check passes
• Tested locally
• CHANGELOG updated (if user-facing)
• Verdict above matches the exact PR head, not an earlier commit

[Yeachan-Heo]

Signed: Yeachan-Heo / fresh-context hostile review

GJC verdict: APPROVE exact head caf2edf.

Admission and scope:

• @sj0618 is an external CONTRIBUTOR; the PR is non-draft, clean, one commit, and exactly one commit ahead of dev base 0cc1536.
• Scope is limited to packages/utils/src/which.ts, its focused regression test, and packages/utils/CHANGELOG.md (+40/-5). No overlap with the retired #3622 notifications lane.
• This is the direct successor to #3656. The prior stale-base disposition found no P0/P1; the successor is correctly rebased and preserves the prior blocker resolution.

Hostile review:

• Explicit PATH is passed through to Bun.which and suppresses Darwin Xcode fallback, preventing escape from a caller-constrained lookup path.
• Explicit empty PATH remains distinct from omission.
• cwd and PATH receive separate cache-key namespaces, preventing the prior collision class while leaving relative lookup delegated to Bun.
• The new regression covers PATH override, empty PATH, relative lookup, cache separation, and no Xcode fallback.
• No new subprocess, filesystem, or credential surface was introduced. The changelog accurately records the user-facing behavior.

Evidence:

• Exact-head CI: 21 terminal checks, 16 success, 5 policy skips, 0 failures, 0 non-terminal.
• Isolated exact-head bun test packages/utils/test/which.test.ts: 1 pass, 0 fail.
• Exact-head bun --cwd=packages/utils run check: Biome clean and TypeScript check completed successfully.
• Full isolated package suite was not used as acceptance evidence because the temp snapshot was installed with --ignore-scripts; unrelated native-shell tests then lacked the native addon. The required focused test and package check are green, and hosted CI is fully terminal-green.

No merge or mutation lane opened.