document the `which` constraint for the shimming strategy

[dherman]

An important constraint: some Node packages use which to determine whether a particular tool is installed, so it's important for those tools to become invisible to the running Node process. (For example, testing whether Yarn is installed by shelling out to which yarn.)

Another, even more subtle constraint: we still want to be able to hook installation of global packages when shelling out from a Node process. So we may want to have version-specific shim directories for each Node version. This also needs to be reconciled with the Windows Path environment variable semantics (i.e., that system-wide Path supersedes user Path).