The security machine's brief and environment name only the tools actually on PATH, and say which are missing #9506

Split from #9470: the part a builder can finish from the sandbox.

Done looks like:

• [x] machineNote and machineEnv in src/crew/machines.ts take a lookup (default Bun.which, injected in tests). FORGE_MACHINE_TOOLS lists only the tools found. The brief names the found tools with their reasons and lists the rest as "not installed on this forge", so it never claims a tool that is absent.
• [x] When none of a machine's tools is found, the brief says that in one line. It does not list them as if they were present.
• [x] docs/features/machines.md says the brief reports what is installed, and that installing the tools is a separate, deferred step.
• [x] A test in test/ with an injected lookup that finds gitleaks only: the env holds gitleaks, the note names gitleaks as present and trivy as not installed, and standard gets no note. The test fails without the change.

Files: src/crew/machines.ts, its caller in src/crew/brief.ts (if needed), docs/features/machines.md, a test. Risks: no download and no shelling out. The lookup reads PATH only. Any commit that touches src/http/ needs a Try: line.

Reviewed pull #9509 at its head: ticked machineNote and machineEnv in src/crew/machines.ts take a lookup (default Bun.which, injected in tests). FORGE_MACHINE_TOOLS lists only the tools found. The brief names the found tools with their reasons and lists the rest as "not installed on this forge", so it never claims a tool that is absent.; When none of a machine's tools is found, the brief says that in one line. It does not list them as if they were present.; docs/features/machines.md says the brief reports what is installed, and that installing the tools is a separate, deferred step.; A test in test/ with an injected lookup that finds gitleaks only: the env holds gitleaks, the note names gitleaks as present and trivy as not installed, and standard gets no note. The test fails without the change..