fix(shell): restore always-on PATH after macOS path_helper

path_helper runs after ~/.zshenv in login shells and puts Homebrew ahead of
fnm, pyenv, and ~/.local/bin. Re-source ~/.zshenv from ~/.zprofile and make
prepends idempotent so login and zsh -c resolve the same binaries.

README.md

@@ -35,15 +35,18 @@ From a git checkout (shell stubs only):
 | Path | Role | Reinstall |
 | --- | --- | --- |
 | `~/.zshenv` | Always-on: Homebrew, `~/.local/bin`, `~/.config/zsh/*.zsh`, then `local.zsh` | Overwritten |
+| `~/.zprofile` | Login: re-apply `~/.zshenv` after macOS `path_helper` | Overwritten (extra login lines kept) |
 | `~/.zshrc` | Interactive: omz, plugins, aliases, fzf, zoxide | Overwritten |
 | `~/.config/zsh/*.zsh` | Always-on tool fragments (e.g. `fnm.zsh`) | Left alone (via `patch.sh`) |
 | `~/.config/zsh/local.zsh` | Machine-local overrides (every zsh, including agents) | **Never overwritten** |
 | `~/.config/zshrc/*.zsh` | Personal/tool overlays before oh-my-zsh (interactive) | Left alone |
 | `~/.local/bin/` | User tools + shims (`grok` → Grok CLI; `agent` → Cursor when installed) | Left alone except those two shims |
 
-Core deploy does not manage `~/.zprofile`. The pyenv add-on appends one login
-hook so macOS `path_helper` cannot outrank pyenv shims. Put other machine hooks
-in `local.zsh`.
+macOS login shells run `path_helper` after `~/.zshenv`, which would put Homebrew
+ahead of fnm, pyenv, and `~/.local/bin`. `~/.zprofile` re-sources `~/.zshenv`
+(idempotent prepends) so login and `zsh -c` keep the same PATH. Put other
+machine-local env in `local.zsh`; extra login-only lines can stay in
+`~/.zprofile` below the easyzsh block.
 
 Do **not** put `~/.grok/bin` on PATH. That tree ships an `agent` that shadows
 Cursor. Grok is the `grok` command (`~/.local/bin/grok`). Cursor is `agent`