test(transport): mount conformance loses ast-grep to the hermetic PATH

[ScriptedAlchemy]

transport_acceptance_suite::v2_surface_mount_conformance::every_catalog_binding_is_mounted_on_its_declared_surface fails on origin/master at 474d5c9 on a host where ast-grep is installed but not in /usr/bin or /bin (npm global install, ~/.local/bin):

2 of 501 catalog-declared bindings are not reachable on the surface they declare.
  cli:ast_grep_rewrite (binding binding.cli.ast_grep_rewrite.v1, ...): absent from the `tracedecay tool` command listing
  mcp:ast_grep_rewrite (binding binding.mcp.ast_grep_rewrite.v1, ...): tracedecay_ast_grep_rewrite is absent from the live MCP server's tools/list answer

Reproduce (the CI root-transport selection):

cargo build -p tracedecay -p tracedecay-cli --test transport_acceptance_suite --bins --features tracedecay/test-transport,tracedecay-cli/test-transport
cargo test -p tracedecay -p tracedecay-cli --test transport_acceptance_suite --features tracedecay/test-transport,tracedecay-cli/test-transport -- v2_surface_mount_conformance::every_catalog_binding_is_mounted_on_its_declared_surface

Cause: fixture environment, not product. Since #2447, every fixture child's PATH is the fake-host dir plus /usr/bin:/bin. The daemon resolves ast-grep through TRACEDECAY_AST_GREP_BIN, then PATH, then /usr/local/bin, /opt/homebrew/bin, /usr/bin, /bin. An npm-installed ast-grep sits in none of those (CI's install-ast-grep action runs npm install --global), so the daemon correctly hides ast_grep_rewrite and the conformance sweep reports it unmounted. (/usr/bin/sg on Debian/Ubuntu is newgrp, not ast-grep.)

#2613 also saw this and called it environmental.