An unset variable in path: puts the working directory on PATH

An unset variable in a `path:` entry expands to an empty string, and an empty `PATH`
element means the current directory to POSIX. So this front matter:

```yaml
path:
- $TOOL_DIR
```

silently puts the working directory on `PATH` when `TOOL_DIR` is not set, instead of
contributing nothing.

That is the wrong failure. A test that names a directory it cannot resolve should get a
clear "command not found", not a lookup that quietly searches somewhere the author never
named — and in a sandboxed run the working directory contains fixtures, which is exactly
where a stray executable could sit.

## Proposal

Drop entries that expand to empty, rather than passing them through.

A test asserting that a bare `$VAR` does not put the working directory on `PATH` would pin
it: today that assertion fails.

## Related

jlevy/tryscript#54 asks for `requires:`, which addresses the same underlying problem from
the other side — knowing which binary a run actually resolved rather than trusting `PATH`
composition to have gone as intended.

Locate the code that expands path: entries and inspect how unset variables become PATH elements. Add the proposed test using a bare $VAR, then verify that an empty expansion is omitted and the working directory is not searched; the test should produce a clear command-not-found result.

Written by the indexing model from the issue text.