Review follow-up on the bare stdio PATH fix (#125318):
- `_first_user_which_hit` reused `_npx_bin_candidates`, whose Windows
candidate list is the npx cache layout's `.cmd`/`.exe` pair. A user
install that only ships a `.bat`/`.py` wrapper (stock PATHEXT carries
both) was never found, so the scan returned None and silently fell
back to the managed hit — the #125300 symptom persisted for those
installs. Candidates now come from `_pathext_suffixes`: the child
env's PATHEXT first (shutil.which reads the PARENT's, same source
rationale as `_which_with_config_pathext`), then the parent's, then
the OS default; a command that already carries a PATHEXT suffix is
matched as written.
- The new `_bare_` test fixtures wrote extensionless executables, which
`shutil.which` can never resolve on win32 (PATHEXT suffixes only), so
the tests could only pass on POSIX and the Windows lane skipped the
marker-less file entirely. Fixtures are now platform-shaped via
`_bare_exe` (`python3.exe` on Windows, bare name + 0o755 elsewhere),
and a direct `_first_user_which_hit` unit test covers the
PATHEXT-driven candidate walk cross-platform.
36592bb75c