fix(zshenv): put ~/.local/bin on PATH for every zsh

Non-interactive agent shells (Codex, Claude) skip .zshrc and never saw
user-local tools installed via pipx/uv/grok. Add ~/.local/bin in
.zshenv with an idempotent guard, and source optional
~/.config/zshenv.local for machine-local early env.

.zshenv

@@ -6,3 +6,21 @@ if [ -x /opt/homebrew/bin/brew ]; then
 elif [ -x /usr/local/bin/brew ]; then
     eval "$(cd /tmp && /usr/local/bin/brew shellenv)"
 fi
+
+# User-local binaries (pipx, uv tools, grok CLI, etc.).
+# Lives here rather than .zshrc/.zprofile so non-interactive agent shells
+# (Codex, Claude Code, CI zsh -c) still resolve user-installed tools.
+if [ -d "$HOME/.local/bin" ]; then
+    case ":${PATH}:" in
+        *":$HOME/.local/bin:"*) ;;
+        *) PATH="$HOME/.local/bin:${PATH}" ;;
+    esac
+    export PATH
+fi
+
+# Machine-local early env (cargo, private PATH bits). Survives easyzsh reinstalls
+# of this file. Prefer this over editing ~/.zshenv by hand.
+if [ -f "$HOME/.config/zshenv.local" ]; then
+    # shellcheck disable=SC1090,SC1091
+    . "$HOME/.config/zshenv.local"
+fi