Per-profile fallback for managed binaries.
Preferred location is InstallationPaths.managed_bin_dir, so profiles can
share one verified download. This is used when that directory is not
writable — a root-owned or system install prefix — because sharing is a
convenience and a working rg is not.
