engine: the browser-installed check uses the standard library's lookup of an executable (final review: reuse, checks.py)

Finding: checks.py wrote its own lookup of the browser command (absolute or
relative path, else each directory of PATH, isfile and X_OK), which is what
shutil.which does. REUSED: _is_installed is shutil.which(command, path=path), the
guest's PATH still passed in (the engine's own, not the process's). The behavior is
the same for every case the tests cover (a name found through the path, an absolute
path with an empty path, a file that is not executable, no path at all), and those
tests are unchanged and pass; no new test is added because there is no new behavior
to fail before. 9 lines fewer, no second copy of the rule.

invisible_engine_dots/nanobot/dots/checks.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import asyncio
 import os
+import shutil
 import time
 from collections.abc import Awaitable, Callable
 from dataclasses import asdict, dataclass
@@ -105,9 +106,5 @@ async def _can_connect(target: str, timeout_s: float) -> bool:
 
 
 def _is_installed(command: str, path: str) -> bool:
-    """Whether `command` names an executable file, directly or through `path`."""
-    if os.path.isabs(command) or "/" in command:
-        candidates = [command]
-    else:
-        candidates = [os.path.join(directory, command) for directory in path.split(os.pathsep) if directory]
-    return any(os.path.isfile(candidate) and os.access(candidate, os.X_OK) for candidate in candidates)
+    """Whether `command` names an executable file, directly or through `path` (the standard library's own lookup)."""
+    return shutil.which(command, path=path) is not None