Dedup PATH probe and fix double mise install across reconcile scripts

[ChipWolf]

Context

Two related frictions in the Unix reconcile scripts:

1. Copy-pasted PATH probe. The "find brew/mise in common prefixes" loop is duplicated verbatim across three scripts (a slight variant in the third).
2. mise install runs twice on config change. It runs in the bootstrap script and in the dedicated mise onchange reconciler, so a chezmoi apply that touches mise config invokes mise install from both. The bootstrap-vs-onchange responsibility seam leaks: bootstrap should bring up first-run state, the onchange scripts should own ongoing reconciliation.

Files

• home/.chezmoiscripts/run_onchange_after_mise_install.sh.tmpl (PATH loop; mise install)
• home/.chezmoiscripts/run_onchange_after_skills.sh.tmpl (identical PATH loop)
• home/.chezmoiscripts/run_onchange_after_brew_review.sh.tmpl (variant PATH loop via brew shellenv)
• home/.chezmoiscripts/run_onchange_after_bootstrap.sh.tmpl (also runs mise install)

What to do

1. Add home/.chezmoitemplates/ensure-brew-on-path.sh.tmpl and source it from all three scripts so the prefix list lives in one place.
2. Decide and document the bootstrap↔onchange seam: let the onchange reconcilers be the single source of truth for mise install (and pi packages / skills), so bootstrap only triggers the first apply rather than re-running each step. Remove the redundant mise install from bootstrap (or gate it to first-run only).
3. Confirm a no-op chezmoi apply doesn't run mise install twice; confirm first-run provisioning still installs everything.

Out of scope

• Windows equivalents (tracked separately).
• Changing the mise/brew tool sets.