An unset variable in path: puts the working directory on PATH

还没有人认领这个 Issue。

An unset variable in a `path:` entry expands to an empty string, and an empty `PATH`
element means the current directory to POSIX. So this front matter:

```yaml
path:
- $TOOL_DIR
```

silently puts the working directory on `PATH` when `TOOL_DIR` is not set, instead of
contributing nothing.

That is the wrong failure. A test that names a directory it cannot resolve should get a
clear "command not found", not a lookup that quietly searches somewhere the author never
named — and in a sandboxed run the working directory contains fixtures, which is exactly
where a stray executable could sit.

## Proposal

Drop entries that expand to empty, rather than passing them through.

A test asserting that a bare `$VAR` does not put the working directory on `PATH` would pin
it: today that assertion fails.

## Related

jlevy/tryscript#54 asks for `requires:`, which addresses the same underlying problem from
the other side — knowing which binary a run actually resolved rather than trusting `PATH`
composition to have gone as intended.

定位扩展 path: 条目的代码，并检查未设置的变量如何变成 PATH 元素。添加使用裸 $VAR 的提议测试，然后验证空扩展会被省略且不会搜索工作目录；该测试应产生明确的 command-not-found 结果。

由索引模型根据 Issue 内容生成。