workstation: put ~/.local/bin on PATH so the launcher finds native claude

Viktor hit "~/.local/bin is not part of the PATH". Root cause: the native claude
binary lives in ~/.local/bin, but the terminal launcher (start-claude.sh) runs in
tmux's NON-login bash env, which doesn't source the user's shell rc where the native
installer put ~/.local/bin on PATH. So `command -v claude` failed there → the
launcher's bootstrap re-ran the native installer → the installer printed the PATH
warning. (Interactive zsh already had ~/.local/bin via the per-user installer rc edit,
and t3-serve sets PATH in its unit — so only the terminal launcher was affected.)

- skel/start-claude.sh: prepend ~/.local/bin to PATH near the top (guarded/idempotent),
  before the launch logic — so `claude` is found, no reinstall, no warning.
- setup-devvm.sh: install /etc/profile.d/10-local-bin.sh — adds ~/.local/bin to PATH for
  all LOGIN shells machine-wide (SSH etc.), independent of the per-user installer rc edit
  (fresh-user-safe). zsh login picks it up via /etc/zsh/zprofile -> /etc/profile.
- docs/architecture/multi-tenancy.md: documented the three PATH-injection points.

Verified: guard adds-when-missing / no-dup-when-present; all scripts pass bash -n.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workstation/setup-devvm.sh

@@ -38,6 +38,23 @@ if [[ $need_node -eq 1 ]]; then
   apt-get install -y nodejs >/dev/null
 fi
 
+# 2a) ~/.local/bin on PATH for all LOGIN shells (machine-wide). The native claude install
+#     lives at ~/.local/bin; this guarantees login shells (SSH, etc.) find it regardless of
+#     whether the per-user native-installer rc edit ran. (The terminal launcher sets PATH
+#     itself, and t3-serve@.service hard-sets PATH in the unit.)
+install -d -m 0755 /etc/profile.d
+cat > /etc/profile.d/10-local-bin.sh <<'PROFILE_EOF'
+# Native per-user installs (e.g. claude-code) live in ~/.local/bin — put it on PATH.
+# Guarded so it never duplicates. Sourced by login shells (bash via /etc/profile; zsh
+# login via /etc/zsh/zprofile -> /etc/profile).
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) export PATH="$HOME/.local/bin:$PATH" ;;
+esac
+PROFILE_EOF
+chmod 0644 /etc/profile.d/10-local-bin.sh
+log "/etc/profile.d/10-local-bin.sh (~/.local/bin on PATH for login shells)"
+
 # 2b) t3 (the per-user coding surface) — PINNED, never nightly/latest. t3 is pre-1.0 and
 #     ships breaking auth-schema + bootstrap-API changes our t3-dispatch can't follow blind
 #     (2026-06-09 outage: a nightly auto-update broke pairing for ALL users). The daily