Interrogate the replacement binary and return the set of applets it claims to support,
intersected with the provided allow list. Falls back to allow if probing fails
or finds an obviously tiny set (< 3).
Resolve the set of applets to link during use for a given package, by
interrogating the replacement binary, intersecting with distro-provided
commands when available, and falling back to the static list if needed.