478a09c06b
Profile-spawned workers (kanban bots, cron jobs) can inherit a PATH of only version-manager dirs — observed in the wild as one nvm node dir repeated 7x. The uv-installed browser-use binary is a POSIX sh trampoline that resolves dirname/realpath through PATH, so it died with 'realpath: not found … exec: /python: not found' (exit 127) before its own Python ever started. _base_subprocess_env now floors the child PATH via browser_tool's _merge_browser_path (the agent-browser backend already guards the same hazard), degrading to appending FHS bin dirs if that import is ever unavailable. Windows is a no-op (.cmd shims don't trampoline). Verified: unit tests + real uvx browser-use --version under a nvm-only-PATH worker env, rc 127 -> rc 0.