fix(mise): correct PATH precedence, error handling, and shell detection

- Append non-mise PATH entries so mise shims keep highest precedence
- Remove legacy cargo bin from initial PATH bootstrap
- Detect current shell for mise activate instead of hardcoding bash
- Rename AWS_SESSION_TOKEN to AWS_SESSION_TOKEN_FILE (was a file path)
- Add exit-on-failure checks to dfm mise install block
- Fix reset_nvim to call mise instead of removed npm installer
- Forward all args in dfm mise-cleanup
- Auto-detect DOTFILES in cleanup script when not pre-exported
- Report brew uninstall failures instead of masking with || true
- Fix p10k segment name from MISE to ASDF
- Replace npm with yarn in CLAUDE.md Bash whitelist

CLAUDE.md

@@ -199,7 +199,8 @@ Instead use:
 ## REDIRECTED tools — use sandbox equivalents
 
 ### Bash (>20 lines output)
-Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
+Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `yarn install`, `pip install`,
+and other short-output commands.
 For everything else, use:
 - `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
 - `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context