fix(cli): ensure $EMACSDIR/lisp/cli is in $DOOMPATH

If $DOOMPATH is malformed or set to a value that does not contain a
valid path to Doom's CLI library in $EMACSDIR/lisp/cli (see #7608),
bin/doom no longer functions, emitting "a subcommand is required"
errors.

This change ensures that the CLI library is always the last (implicit)
element in doom-cli-load-path, and ensures $DOOMPATH is never written to
the user's envvar file (in case they try to use bin/doom from inside a
terminal within a Doom Emacs session), which should ensure users -- at
least -- never find themselves stranded without the Doom CLI.

Fix: #7608
Co-authored-by: bpizzi <bpizzi@users.noreply.github.com>

lisp/cli/env.el

@@ -33,7 +33,8 @@
     "^SSH_\\(AUTH_SOCK\\|AGENT_PID\\)$" "^\\(SSH\\|GPG\\)_TTY$"
     "^GPG_AGENT_INFO$"
     ;; Internal Doom envvars
-    "^DEBUG$" "^INSECURE$" "^\\(EMACS\\|DOOM\\)DIR$" "^DOOMPROFILE$" "^__")
+    "^DEBUG$" "^INSECURE$" "^\\(EMACS\\|DOOM\\)DIR$"
+    "^DOOM\\(PATH\\|PROFILE\\)$" "^__")
   "Environment variables to omit from envvar files.
 
 Each string is a regexp, matched against variable names to omit from

lisp/doom-cli.el

@@ -92,15 +92,14 @@
   :group 'doom)
 
 (defvar doom-cli-load-path
-  (let ((paths (split-string (or (getenv "DOOMPATH") "") path-separator)))
-    (if (member "" paths)
-        (cl-substitute (doom-path (dir!) "cli/") "" paths :test #'equal)
-      paths))
+  (append (when-let ((doompath (getenv "DOOMPATH")))
+            (cl-loop for dir in (split-string doompath path-separator)
+                     collect (expand-file-name dir)))
+          (list (file-name-concat (dir!) "cli")))
   "A list of paths to search for autoloaded Doom CLIs.
 
 It is prefilled by the DOOMPATH envvar (a colon-separated list on Linux/macOS,
-semicolon otherwise). Empty entries in DOOMPATH are replaced with the
-$EMACSDIR/cli/.")
+semicolon otherwise).")
 
 ;;; CLI definition variables
 (defvar doom-cli-argument-types