`os.Stat` succeeds on a directory, so the previous resolver happily
accepted a directory path and forwarded it to the Docker bind-mount +
exec path, where it surfaced as a confusing "permission denied" /
"exec format error" deep in container bootstrap.
Validate `info.Mode().IsRegular()` up front and return a clear error
naming the env var.
José Almeida
970956fb90