prepend_managed_bin_to_path() -> NoneIdempotently expose managed ripgrep through os.environ["PATH"].
Safe to call on every startup. The installation-scoped directory is
prepended directly. A verified profile fallback is exposed through a
process-private shim containing only rg, because the profile may be
repository-controlled. Both managed directories are removed from the rest
of PATH so neither a stale copy nor a fallback sibling can shadow it.
Prepending only one directory matters for the profile fallback. TB14
permits a DEEPAGENTS_HOME inside a checkout, so <profile>/bin can be a
repository-controlled directory. Verifying rg does not make siblings
such as git trustworthy, so that directory never enters PATH.