Function tool_binary_name 

pub fn tool_binary_name(env_var: &str, default: &str) -> String

Resolve an external tool’s binary path, honoring a per-tool env-var test seam. Production code reads no env var and gets default (which Command resolves via PATH); tests set env_var to an absolute path of a shim binary. This is the SOLE supported override pattern for external CLIs.

Empty env_var ("") is treated as “no seam” and returns default unchanged; callers may dispatch a per-binary seam via match and fall through to "" for unseamed binaries without panicking.

Naming convention: every active seam uses CFGD_<NAME>_BIN (e.g. CFGD_COSIGN_BIN, CFGD_AGE_BIN, CFGD_BREW_BIN, CFGD_APT_CACHE_BIN). New backends MUST follow this shape and reuse this helper rather than reinventing the override surface — keeps the test-shim ergonomics uniform. Pair every seam consumer with serial_test::serial because env-var mutation is process-global.