Use the user's login shell, and fix login-shell argv

Two separate problems made the terminal run the wrong shell:

Pty.create took a single argv slice and used argv[0] as both the exec path
and the argument vector's first entry. Session passed {shell, "-shell"},
so the shell received "-zsh" as an ordinary argument rather than as its
argv[0]. Bash quietly tolerated it; zsh rejects it and exits immediately,
which closed the tab and took the window down with it. The exec path and
argv are now separate parameters.

Shell resolution preferred $SHELL, which describes whichever shell launched
us rather than the one the user configured. Inside 'nix develop' that is
Nix's own minimal bash, so the terminal never opened the user's zsh. We now
read the login shell from the passwd database and keep $SHELL only as a
fallback for systems without a usable passwd entry.

shot.sh no longer forces a shell, so screenshots reflect real behavior.

README.md

@@ -75,7 +75,8 @@ in principle, but a terminal grid is small.
 
 ## What works
 
-- Real shell on a real PTY, with a controlling terminal so job control,
+- Your login shell (from the passwd database, not `$SHELL`) on a real PTY,
+  started as a login shell, with a controlling terminal so job control,
   Ctrl-C and SIGWINCH behave
 - Full SGR rendering: 16/256/true color, bold, italic, underline,
   strikethrough, inverse, and the bright-on-bold convention
@@ -120,9 +121,6 @@ Sway** and screenshots it. This keeps UI checks entirely out of your real
 Wayland session — nothing appears on screen, and it works while the session is
 locked.
 
-Screenshots use `$SHELL` like the real app does; set
-`VTABS_SHOT_SHELL=/bin/sh` for output uncluttered by your shell's rc files.
-
 One caveat when driving it: `wtype` loses the first keystroke of every
 invocation while the compositor adopts its freshly uploaded keymap, so scripted
 input should begin with a throwaway key. That is a quirk of the injection tool,