fix: don't fallback to system 'sg' command for ast-grep

On Linux systems, 'sg' is a mailutils command, not ast-grep. The previous
fallback would silently run the wrong binary when ast-grep wasn't found.

Changes:
- getSgCliPath() now returns string | null instead of string
- Fallback changed from 'sg' to null
- Call sites now check for null and return user-facing error with
  installation instructions
- checkEnvironment() updated to handle null path

Fixes #1365

src/tools/ast-grep/cli.ts

@@ -86,10 +86,22 @@ export async function runSg(options: RunOptions): Promise<SgResult> {
 
   let cliPath = getSgCliPath()
 
-  if (!existsSync(cliPath) && cliPath !== "sg") {
+  if (!cliPath || !existsSync(cliPath)) {
     const downloadedPath = await getAstGrepPath()
     if (downloadedPath) {
       cliPath = downloadedPath
+    } else {
+      return {
+        matches: [],
+        totalMatches: 0,
+        truncated: false,
+        error:
+          `ast-grep (sg) binary not found.\n\n` +
+          `Install options:\n` +
+          `  bun add -D @ast-grep/cli\n` +
+          `  cargo install ast-grep --locked\n` +
+          `  brew install ast-grep`,
+      }
     }
   }