refactor `which` code to use `command which`

This appears to be more portable and resistant
to reporting aliases rather than absolute paths.