fix: mirror host path semantics in search-path-guard (review follow-up)

Address review feedback on #1118:
- Drop the trim: the host consumes args.path as-is, so the guard must
  validate the exact string the host will execute.
- Drop the 'undefined'/'null' sentinel skip: upstream dev has no runtime
  sentinel handling; those literals resolve as ordinary relative paths.
- Only ENOENT maps to 'Search path does not exist'; other stat errors
  (EACCES/EIO/ENOTDIR) pass through instead of being misdiagnosed.