### Summary This PR generalizes the empty-`PATH` protection for OCI images (issue #729). Previously this behavior applied only when `base == "bare"`. The final image environment is now inspected for every base, after project-defined environment variables have been applied. ### Behavior - If `PATH` is missing or its final value is empty (`PATH=`), set it to `Pebble.DEFAULT_ENV_PATH`. - If the final `PATH` value is non-empty, preserve it. - When multiple `PATH` entries exist, the last assignment wins. The implementation reads the final image environment through `skopeo inspect` and writes the default only when necessary. ### Packaging order `set_default_path()` runs after `set_environment()`, preventing a project-level `PATH: ""` from overwriting the safe default after validation. ### Tests Unit coverage includes: - `PATH` present: inspect only, no config write; - `PATH` missing: inspect and configure the default; - `PATH` empty: inspect and configure the default; - duplicate `PATH` entries with last-assignment semantics; - package orchestration applying project environment before final `PATH` validation. Validation performed: - focused OCI and package-service suite: 56 passed; - unit suite: 644 passed, 1 environment-dependent APT test deselected; - the deselected APT test fails identically on current `upstream/main` because the local environment lacks the APT package backend; - Ruff check and format check passed for all four changed files; - `git diff --check` passed. Refs #729