Move SystemEnvironmentReader's listing arguments and search-path rules out of the excluded file and test them

## What happens

`Sources/UttrflowPredict/EnvironmentReading+System.swift` is excluded from coverage in `Scripts/coverage_report.py` because it runs git, reads directories and scans `PATH`. It also holds pure static rules that no test calls:

- `listingArguments(for:)` (lines 142-149): `cargo --list`, `brew commands --quiet`, `npm help`, otherwise `--help`;
- `searchPaths()` (lines 108-113): the launch `PATH` followed by the extra search paths, with duplicates removed and order kept;
- the dispatch in `verbs(of:in:)` (lines 122-139) choosing git, Makefile, package scripts or help output.

`resolve(_:from:)` in the same file is tested, in `EnvironmentSourceTests`, but doesn't count toward the module's number while the file is excluded.

Measured on origin/main `26d7bc1` with `swift test --enable-code-coverage` (5,384 tests, all passing) and `xcrun llvm-cov export` over the test binary. The regions named below have an execution count of 0: no test runs them, so a change that breaks them passes `make verify`.

## Why it matters

Asking a program for its verbs runs that program. If `listingArguments` gets `brew` wrong, the AI suggestions run `brew` with no arguments, which prints help, or with a different subcommand, and the verbs learned are wrong. These rules are small and pure, so there's no reason they sit outside the 95% floor.

## How to reproduce

Read `Scripts/coverage_report.py` (the exclusion reason for this file) and run `grep -rn "listingArguments\|searchPaths" Tests`, which finds nothing.

## Acceptance criteria

- `listingArguments(for:)` and a `searchPaths(environment:)` variant (taking the `PATH` string, so a test can pass one) live in a non-excluded file in `UttrflowPredict`, for example beside `EnvironmentSource`.
- Tests cover each named program and the default, and `PATH` values with duplicates, empty components, and an entry that is also one of the extra search paths.
- The exclusion reason in `coverage_report.py` still describes what is left in the file.
- Each new test fails when the branch it covers is broken. Check this by hand before opening the PR: temporarily change the branch (flip the condition or return the other value), see the test fail, then restore it.

## Where to start

- `Sources/UttrflowPredict/EnvironmentReading+System.swift`, `Sources/UttrflowPredict/EnvironmentSource.swift`, `Tests/UttrflowPredictTests/EnvironmentSourceTests.swift`.
- Umbrella: #641.

Read `CONTRIBUTING.md` first. Iterate with `swift test --filter `, then run `make verify` before pushing. Only tests change; no product code needs to.

**Size:** S.

Read CONTRIBUTING.md first, then inspect Sources/UttrflowPredict/EnvironmentReading+System.swift, EnvironmentSource.swift, and Tests/UttrflowPredictTests/EnvironmentSourceTests.swift. Move the named pure rules into a non-excluded file, add tests for each listing program and PATH case, and confirm them with filtered swift tests and make verify. The coverage exclusion should still describe the remaining work.

Written by the indexing model from the issue text.