fix(#304): don't claim "verified on your PATH" when the current shell can't find tracebloc

[saadqbal]

Closes#304.

The post-install verify spawns fresh shells to prove the CLI persists into new terminals — but the shell that ran the installer predates the ~/.local/bin PATH edit, so it printed "verified on your PATH" while the user's next tracebloc … in that same shell failed with command-not-found.

Now the clean "verified on your PATH" verdict is gated on has tracebloc (this shell resolves it too). When it persists for new terminals but the current shell can't see it yet, it says so and points to a new terminal / source <rc> instead.

Tests: install-cli.bats 9/9 (fixed the old test that encoded the buggy expectation; added one for the current-shell-lacks-it case).

🤖 Generated with Claude Code

---

Note

Low Risk
Installer UX and messaging only; verification remains non-fatal and behavior for shells that already have the CLI on PATH is unchanged.

Overview
Fixes misleading post-install messaging when tracebloc is on PATH in new shells (via rc) but not in the shell running the installer (#304).

_verify_tracebloc_cli still uses _cli_on_fresh_path to confirm persistence, but "verified on your PATH" is shown only when has tracebloc succeeds in the current shell. If fresh shells resolve the binary but this one does not, the installer reports "verified for new terminals" and hints to open a new terminal or source the shell rc (fish gets a shorter message), without re-appending PATH lines that are already in the rc.

Bats coverage splits the old single fresh-shell test into the full PATH case (has succeeds) and the #304 case (has fails), and scripts/manifest.sha256 is updated for install-cli.sh.

^{Reviewed by Cursor Bugbot for commit 1fd0696. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 33 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#143 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned
• averaging-service#156 — feat(strategies): FedMedian Byzantine-robust aggregation (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#157 — feat(strategies): FedTrimmedAvg Byzantine-robust aggregation (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#158 — feat(strategies): Krum / MultiKrum Byzantine-robust selection (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#159 — feat(strategies): FedProx aggregation strategy (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#160 — feat(strategies): FedOpt family — FedAdam / FedYogi / FedAdagrad (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#161 — feat(strategies): resolve per-experiment aggregation hyperparameters (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · no reviewer assigned
• backend#926 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · reviewer: @saadqbal
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

Superseded-in-principle by the real R7 fix in tracebloc/cli#131 (PR tracebloc/cli#132): client create now adopts the live in-cluster client and backfills its cluster_id instead of minting a duplicate.

Keeping this as interim protection though — R7 only kicks in once the CLI release the installer pulls carries it (and dev/prod run a backend build with #893). Suggest: merge this now, then a small follow-up drops this pre-flight once the R7 CLI is released. The install-client-helm one-client guard stays either way as the backstop.

[saadqbal]

Correction: my earlier "superseded by R7" comment on this PR was misfiled — it belongs on #306 (the one-client band-aid). This PR is the independent PATH-visibility fix (#304) and stands on its own. Sorry for the noise.