🐛 Conda: Let activated envs win over ~/.local/bin on PATH

[mbercx]

The ~/.local/bin symlinks are meant as a convenience layer so that unpackaged binaries from each code env are reachable without activating anything, but they were shadowing the real env binaries after workon:

(koopmans) max@qmobile:~$ which pw.x
/home/max/.local/bin/pw.x
(koopmans) max@qmobile:~$ echo $PATH
/home/max/.local/bin:/home/max/.conda/envs/koopmans/bin:...

The cause is ordering in ~/.bashrc. The previous symlink task wrote an

`export PATH="$HOME/.local/bin:$PATH"`

block at end-of-file via blockinfile (default position), which runs AFTER the miniforge-managed conda initialize block. So conda would correctly swap in the env's bin/ on activation, but the later ~/.local/bin export then re- prepended itself and won every lookup. For binaries that are symlinks into the env this was a no-op; for binaries that exist in the env but NOT as symlinks (e.g. anything not listed in bin_patterns) it still looked right; but for anything symlinked from a DIFFERENT env it was wrong — workon koopmans still resolved pw.x to the qespresso env.

Here we extract the ~/.local/bin setup into a dedicated local/tasks/setup-local-bin.yml and run it from playbook-build-dev.yml once, before the conda install. The export block now uses insertbefore: BOF so it lands at the top of .bashrc, to be sure it lands before the conda init block that miniforge appends later in the file. After a login shell initialises, conda activate prepends the env bin and wins over ~/.local/bin.

Also drop the directory-create and block-management steps from conda-env-install.yml, since the base layer now guarantees both — the task is reduced to the symlink loop, which is the part that is actually per-env.

[mbercx]

CI passes: rebasing + merge