fix: resolve chezmoi instead of assuming it is on PATH

The private tier died with `chezmoi: not found` on a real install, AFTER the
bws token had been written -- half-configured, at the last step, password
already spent.

dotup arrives VIA chezmoi, so "it must be here already" is the natural
assumption. It is wrong: get.chezmoi.io installs to ./bin relative to the CWD
when -b is not given, which is exactly what the README's one-liner does. Run it
from $HOME and the binary is ~/bin/chezmoi; run it from /workspace, as anyone
in a container does, and it is /workspace/bin/chezmoi. Neither is on PATH, and
~/.local/bin is not either in bash -- the same gap that makes bare `dotup` fail
on a fresh box.

find_tool exists for precisely this and the call site bypassed it.

  - find_tool now also searches $HOME/bin
  - ensure_chezmoi resolves it, and installs to ~/.local/bin only if it truly
    is absent, mirroring ensure_bws
  - the init uses "$CHEZMOI", never the bare name
  - resolution happens BEFORE the credential prompt, so this fails while it is
    still free rather than after the password is spent

Verified by reproducing the exact scenario: installer run from /workspace, so
chezmoi lands in /workspace/bin and nothing on PATH can see it. Old code:
`chezmoi: not found`. New: detected, installed, prompt reached. Also confirmed
~/bin/chezmoi is found WITHOUT re-downloading, so the common case costs nothing.

113 -> 117.

.tests/test.sh

@@ -195,6 +195,23 @@ is "PRIV_CFG is not the default config path" "0" \
 is "the private source is locked down after clone" "1" \
    "$(grep -c 'chmod -R go-rwx "\$PRIV_SRC"' $D)"
 
+printf '\n\033[1mchezmoi is not assumed to be on PATH\033[0m\n'
+# dotup ARRIVES via chezmoi, so "it must be here already" is the natural
+# assumption and it is wrong: get.chezmoi.io installs to ./bin relative to the
+# CWD when -b is not given, which is what the README one-liner does. From
+# /workspace that is /workspace/bin, on no PATH anywhere. The private tier died
+# with `chezmoi: not found` AFTER writing the bws token.
+is "nothing calls chezmoi by bare name" "0" \
+   "$(grep -cE '^[[:space:]]*chezmoi (init|apply|update)' $D)"
+is "the init uses the resolved path"    "1" \
+   "$(grep -cF '"$CHEZMOI" init --apply' $D)"
+is "find_tool looks in ~/bin too"       "1" \
+   "$(grep -cF '"$HOME/bin/$1"' $D)"
+# Resolution happens before the prompt: discovering it afterwards means the
+# password is spent and the token is already on disk.
+is "chezmoi is resolved before the password is asked for" "yes" \
+   "$(awk '/ensure_chezmoi \|\|/{e=NR} /head_ "private tier"/{h=NR} END{print (e && h && e<h) ? "yes" : "no"}' $D)"
+
 printf '\n\033[1ma wrong password is not a reinstall\033[0m\n'
 # The endpoint credentials are asked for at the very END of a run, after every
 # package is installed. Any non-200 used to be fatal, so one mistyped character