Nix isn’t really designed to do that. It’s a functional DSL for managing build scripts. Even if you could manage file paths with it this way, it would probably be painful and inefficient.
That said, I’m a bit confused by your derivations here. You put in a lot of effort to create “wrapped” “executables”, but the only difference between un-wrapped and wrapped is that the wrapped ones have a shebang of "#!${stdenv.shell}".
For reference, “wrapped” in nixpkgs usually refers to binaries that need to have special environment variables set, and therefore have “wrapping” scripts that set those variables and then execute the binaries. Patching shebangs usually happens directly on the scripts, so I’m not sure how we ended up with this.
The “un-wrapped” binaries are provided from a nix derivation in the first place anyway - are you sure they don’t already have the correct shebangs set? Nix will automatically patch shebangs after installPhase, see the fixupPhase section in the stdenv manual entry.
If it they don’t already have the correct shebangs, that is most likely because your scripts aren’t set to be executable at the end of the install phase. So rather than trying to hack around the paths in default.nix, I would instead put this at the end of installPhase in runtime.nix.
Now, all of that said, the problem you’re describing is very hard to solve! Since you’re rewriting shebangs, I assume these are all scripts, but either way, the only way to identify whether a file is “executable”, unless it has the executable permission set, is to check if it starts with a shebang. To my knowledge, you can’t easily do this with a single command in bash, and no matter which language you do it in it will be somewhat slow because you need to check file contents.
If the shebangs are really not already correct when you’re creating your fhs env, and you’re sure the patchShebangs hook runs in fixupPhase, I’d suggest trying to go upstream and seeing if they’d be willing to make their install script make files executable before trying to hack this. But I’d be very surprised if it doesn’t do that already.
If you’re absolutely positive you need to hack this, we can work out a grep or a find or an awk or something, but that should be a last resort.