Add hint_is_system_binary() to short-circuit detection for plists that
use /bin/*, /usr/bin/*, /usr/libexec/* etc. as their program path.
These are custom scripts, not app-backed launch agents, so the stale
detection logic does not apply. Previously the function relied on the
absence of AssociatedBundleIdentifiers as an implicit skip, which could
fail on certain macOS plutil edge cases.
Also add teardown() in clean_hints.bats to explicitly remove the
LaunchAgents directory after each test, and add run_with_timeout mock
in the "skips custom shell wrappers" test to prevent mdfind from
influencing results. This eliminates the intermittent failure where
test 70 showed "Review:" in output without "Potential stale login item:".
