Harden secure path validation

[ConnorNelson]

Summary

• require the target script to be executable before parsing or invoking it, including direct /usr/bin/exec-suid /path/to/script usage
• reject path components that are world-writable without the sticky bit
• report more specific secure-path and nosuid mount errors
• add secure-path regression tests through the shared run_program fixture

Fixes #15.

Validation

• docker build -t exec-suid-secure-path /tmp/exec-suid-pr >/tmp/exec-suid-secure-path-build.log && docker run --rm exec-suid-secure-path
• git diff --check