address remaining Copilot remark: verify versioned pkgx candidate

Copilot's review on 18e0471 flagged that the versioned-layout fallback
(`~/.pkgx/pkgx.sh/v<x.y.z>/bin/pkgx`) picked candidates based only on
the directory-name semver and existence of the binary, while the other
fallback paths (~/.local/bin/pkgx, /usr/local/bin/pkgx) verify
candidates with pkgx_meets_minimum(). A stale, non-executable, or
version-mismatched v*/bin/pkgx could therefore be returned and break
the inner sudo invocation.

Keep the directory-name semver as a cheap pre-filter — it lets us skip
old-version dirs without spawning --version per entry — but verify the
actual binary with pkgx_meets_minimum() before accepting it as `best`.

The other two Copilot remarks on this commit either don't apply
(Linuxbrew exemption already landed in e1104ea, sits before the
/home|Users/ rejection) or are stale (the ci.yml comment refers to
`set -ux` / `rc=$?` from ea4dab6 which I already removed in 18e0471;
the current step uses `set -eux`).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tannevaled

pkgm.ts

@@ -884,6 +884,11 @@ function pkgx_reachable_as(current: string, user: string): string | undefined {
               if (v.lt(PKGX_MIN_VERSION)) continue;
               const path = join(root, entry.name, "bin/pkgx");
               if (!existsSync(path)) continue;
+              // Directory-name version is a cheap pre-filter; verify the
+              // actual binary too, matching the other fallback paths so a
+              // stale or non-executable `v*/bin/pkgx` can't be returned
+              // (per #86 review).
+              if (!pkgx_meets_minimum(path)) continue;
               if (!best || v.gt(best.v)) best = { v, path };
             } catch {
               // skip malformed version dir