Function bake 

pub fn bake(shim: &str, bin: &str) -> String

Write the absolute binary path into a shim.

A plain global replace, which is why the shim’s own comment must not spell the token out — it did, and every baked shim carried an “explanation” whose text was a machine path. Idempotent: re-baking a baked shim is a no-op because the token is gone.