`fish_add_path` reorders $PATH in subshell without `--move`

`fish_add_path` docs says:

> If a directory is already included, it is not added again and stays in the same place unless the `--move` switch is given.

In my dotfiles, I add 2 user paths:

```fish
fish_add_path -g ~/code/scripts ~/.local/bin
```

I also use direnv, which prepends `/Users/jsu/code/foo/.venv/bin` to $PATH (not $fish_user_paths!). Note that after this prepend, $PATH no longer begins with $fish_user_paths. This is the result:

```
set in global scope, exported, a path variable with 14 elements
[1] /Users/jsu/code/foo/.venv/bin
[2] /Users/jsu/code/scripts
[3] /Users/jsu/.local/bin
[4] [system paths here]
originally inherited as |[subset of system paths here]|
```

When I start a subshell (e.g. `fish --private`), fish inherits the existing $PATH and then sources my dotfiles again. Despite the 2 user paths already existing in $PATH, they are moved to the front. This is the result:

```
set in global scope, exported, a path variable with 14 elements
[1] /Users/jsu/code/scripts
[2] /Users/jsu/.local/bin
[3] /Users/jsu/code/foo/.venv/bin
[4] [same system paths here]
originally inherited as |/Users/jsu/code/foo/.venv/bin:/Users/jsu/code/scripts:/Users/jsu/.local/bin:[same system paths here]|
```

---

fish: 4.0.2
OS: macOS Sequoia 15.6.1
Terminal: Ghostty 1.1.3