fix(spec): make spec-next T4's gh-free PATH portable to CI

[tieubao]

Summary

• PR feat(spec): mint spec numbers against open PR heads too #661's CI went red: T4 assumed /usr/bin:/bin:/usr/sbin:/sbin never holds gh, true on the author's Mac, false on GitHub's ubuntu runners (gh at /usr/bin/gh), so T4 silently ran the "not authenticated" branch and asserted the wrong stderr note.
• T4 now filters the real $PATH, drops any directory that itself contains a gh executable, and asserts command -v gh fails on the result before running the case.
• T2 (gh present, gh auth status fails -> "not authenticated") is unchanged and stays the separate case for that branch.

Test plan

• bash tests/test-spec-next-pr-scan.sh (gh present ambiently, 8/8 green)
• PATH=/usr/bin:/bin bash tests/test-spec-next-pr-scan.sh (gh absent ambiently, 8/8 green)
• bash tests/run-all.sh (all 152 suites green)
• Negative control via lib/gate/negctl.sh (RED under mutation, GREEN after restore) — see docs/verification/spec-next-t4-gh-free-path.md