oci: set default PATH when missing or empty

[gcomneno]

Summary

This PR generalizes the empty-PATH protection for OCI images (issue #729).

Previously this behavior applied only when base == "bare". The final image
environment is now inspected for every base, after project-defined environment
variables have been applied.

Behavior

• If PATH is missing or its final value is empty (PATH=), set it to
  Pebble.DEFAULT_ENV_PATH.
• If the final PATH value is non-empty, preserve it.
• When multiple PATH entries exist, the last assignment wins.

The implementation reads the final image environment through skopeo inspect
and writes the default only when necessary.

Packaging order

set_default_path() runs after set_environment(), preventing a project-level
PATH: "" from overwriting the safe default after validation.

Tests

Unit coverage includes:

• PATH present: inspect only, no config write;
• PATH missing: inspect and configure the default;
• PATH empty: inspect and configure the default;
• duplicate PATH entries with last-assignment semantics;
• package orchestration applying project environment before final PATH
  validation.

Validation performed:

• focused OCI and package-service suite: 56 passed;
• unit suite: 644 passed, 1 environment-dependent APT test deselected;
• the deselected APT test fails identically on current upstream/main because
  the local environment lacks the APT package backend;
• Ruff check and format check passed for all four changed files;
• git diff --check passed.

Refs #729

[gcomneno]

Hi! Just gently following up on this one.

I rebased the branch onto current upstream/main and re-ran the focused checks locally:

• uv run --group dev python -m pytest -q tests/unit/test_oci.py -rs
• uv run --group lint --group types ruff check rockcraft/oci.py tests/unit/test_oci.py
• uv run --group lint --group types ruff format --check rockcraft/oci.py tests/unit/test_oci.py

The focused test run passes with 51 passed, and Ruff is clean.

Happy to adjust anything else if useful.

[gcomneno]

Friendly ping on this PR. It has been idle for a while, and it should still be ready from my side.

Please let me know if you would like me to rebase, refresh the checks, or adjust anything else.

Thanks!