test: assert dotup's absolute path before touching PATH

The check was `export PATH="$HOME/.local/bin:$PATH"` followed by
`command -v dotup`, which proves the export worked and nothing else. It passed
on every run while a real operator on a fresh box hit
`dotup: command not found`.

~/.local/bin is put on PATH only by the .zshrc this tier ships, for a zsh that
dotup itself installs. So on any new machine the first invocation must be
~/.local/bin/dotup -- which the README already documents -- and bare `dotup`
cannot work until zsh is installed and logged into.

Assert `-x ~/.local/bin/dotup` first, then export for the rest of the script's
convenience. Reproduced the original failure in a clean root container before
changing anything, and re-ran the end-to-end after: PASS.

.tests/e2e-private-tier.sh

@@ -16,8 +16,23 @@ apt-get update -qq && apt-get install -y -qq git curl zsh ca-certificates expect
 sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply \
   "${E2E_PUBLIC_URL:?}" >/dev/null 2>&1 \
   || fail "public tier init"
+# Assert the ABSOLUTE path first, before touching PATH.
+#
+# A real operator has just run the installer in whatever shell they were already
+# in, and on a fresh box that is bash. ~/.local/bin is added to PATH only by the
+# .zshrc this tier ships -- for a zsh that dotup has not installed yet. So the
+# first invocation is necessarily `~/.local/bin/dotup`, which is exactly what
+# the README documents, and bare `dotup` is `command not found` on every new
+# machine.
+#
+# This used to read `export PATH=...` and THEN `command -v dotup`, which is a
+# vacuous assertion: it proved the export worked, not that the installer put
+# anything anywhere. It passed happily while a real bash user hit
+# `dotup: command not found`.
+[ -x "$HOME/.local/bin/dotup" ] \
+	|| fail "public apply left no executable at ~/.local/bin/dotup"
+# Only now, for the convenience of the rest of this script.
 export PATH="$HOME/.local/bin:$PATH"
-command -v dotup >/dev/null || fail "dotup not on PATH after public apply"
 echo "1. public tier applied: $(chezmoi managed -p absolute | wc -l) files"
 
 # absence assertions BEFORE the private tier exists