fix(shell): restore always-on PATH after macOS path_helper

path_helper runs after ~/.zshenv in login shells and puts Homebrew ahead of
fnm, pyenv, and ~/.local/bin. Re-source ~/.zshenv from ~/.zprofile and make
prepends idempotent so login and zsh -c resolve the same binaries.

.zshenv

@@ -1,20 +1,23 @@
 # Always-on env for every zsh (interactive, login, agents, zsh -c).
-# Machine-local overrides: ~/.config/zsh/local.zsh (never overwritten by deploy).
+# Safe to re-source: macOS login shells run this again from ~/.zprofile after
+# path_helper reorders PATH. Machine-local overrides: ~/.config/zsh/local.zsh.
+
+typeset -U path
 
 # Homebrew (macOS). cd /tmp so TCC-protected CWDs do not break brew shellenv.
-if [[ -x /opt/homebrew/bin/brew ]]; then
-  eval "$(cd /tmp && /opt/homebrew/bin/brew shellenv)"
-elif [[ -x /usr/local/bin/brew ]]; then
-  eval "$(cd /tmp && /usr/local/bin/brew shellenv)"
+# Skip when already initialized (login re-apply, nested zsh).
+if [[ -z "$HOMEBREW_PREFIX" ]]; then
+  if [[ -x /opt/homebrew/bin/brew ]]; then
+    eval "$(cd /tmp && /opt/homebrew/bin/brew shellenv)"
+  elif [[ -x /usr/local/bin/brew ]]; then
+    eval "$(cd /tmp && /usr/local/bin/brew shellenv)"
+  fi
 fi
 
 # User-local binaries (pipx, uv tools, grok shim, …).
 # Do not put vendor trees like ~/.grok/bin on PATH wholesale (names like `agent` shadow tools).
 if [[ -d "$HOME/.local/bin" ]]; then
-  case ":${PATH}:" in
-    *":$HOME/.local/bin:"*) ;;
-    *) PATH="$HOME/.local/bin:${PATH}" ;;
-  esac
+  path=("$HOME/.local/bin" ${path:#$HOME/.local/bin})
   export PATH
 fi