Fix exedev runner tool discovery - #56

Summary

Fix recurring executable lookup failures in both exedev Amp runners. Their service
PATHs currently expose the per-user profile but omit installed system tools, so
subprocesses cannot find sh, Bash, Nix, or SSH even though those tools exist.

• Add /run/wrappers/bin and the system profile to the generated service PATHs.
• Keep each account's own profile ahead of system binaries.
• Add qrencode to the shared account-tool package list for existing BankID flows.

No credentials, home permissions, browser settings, networking, sync services, or
finance-sharing configuration are changed. This PR is based on current master,
without the unrelated local flake-update work.

Dasha compatibility

• Evaluated UID 2003, private /home/dasha, service user/working directory, XDG
  runtime directory, and D-Bus address are unchanged.
• Tested the proposed PATH as Dasha: her own Chromium, Ledger and Obsidian binaries
  retain precedence; system shell/Nix/SSH/diagnostic tools resolve.
• Her skills remain readable and finance files remain readable but not writable.
• Her runner remains active with the same PID/start time; nothing was restarted.
• Her user systemd manager was already inactive during read-only inspection, so
  user-level sync health was not established or changed by this work.

Verification

• nix flake check --all-systems --no-update-lock-file passed.
• Explicit build of checks.x86_64-linux.formatting passed.
• Evaluated both generated service PATHs and exercised sh spawning SSH/Nix.
• Local formatter left both changed files unchanged.

Not deployed. Applying a future NixOS switch may restart runners; coordinate that
separately rather than treating this PR as permission to interrupt active sessions.