setup: discount npx's own PATH entry when choosing the invocation

[noammigdali-hio]

Correction, after this was merged. Two claims below are wrong and the fix
is narrower than it should be. Details and a patch are in #7.
Leaving the original text intact so the record of what was merged is accurate.

---

npx -y human-review setup --global writes a SKILL.md that tells agents to run a bare human-review. On a machine without a global install that command does not exist, so every later invocation fails with "command not found".

invocation() probes which human-review to decide which form to write. The probe runs inside the npx call that is doing the setup, and npx has put the package on PATH for the duration of that one command:

$ which human-review
/Users/me/.npm/_npx/f043fcd613c7efad/node_modules/.bin/human-review

That path is gone the moment npx exits, so the probe reports an install that was never there.

This change ignores a resolution living inside npm's _npx cache and falls back to npx -y human-review. A real global install or npm link still wins.

Checked all three cases against invocation() on macOS, node 25.9.0:

PATH holds	resolves to	invocation()
the npx cache copy	~/.npm/_npx/<hash>/node_modules/.bin/human-review	npx -y human-review
a real bin dir	/tmp/.../bin/human-review	human-review
nothing		npx -y human-review

One test added, covering the cache path on both platforms, a real global install, and a directory that merely contains the characters _npx. 68 pass.

Found this installing the skill today, so the SKILL.md on my machine needed the npx -y prefix put back by hand.

🤖 Generated with Claude Code