test: isolate user state during test runs

[guix4ever]

Summary

Isolate every Node test worker from the developer's real home directory so the suite cannot read or overwrite persistent EvoMap identities, credentials, mailbox state, or proxy settings. Replace the shell-interpolated npm test command with a cross-platform argv-based runner that always preloads the isolation setup.

What changed

• Added a test-suite runner that starts Node with an explicit argv array and preloads the isolation setup.
• Assigned each test worker a unique temporary HOME, USERPROFILE, EVOLVER_HOME, and EVOLVER_SETTINGS_DIR.
• Removed each temporary test home when its worker exits.
• Added an end-to-end regression test proving identity and settings files stay out of the parent home.
• Updated the ATP proxy routing fixture to honor the isolated settings directory.
• Added no runtime dependencies and changed no production behavior.

How to test

1. Run npm test.
2. Expect 3290 tests to pass with 0 failures.
3. Run node --test test/testHomeIsolation.test.js.
4. Expect both isolation regression tests to pass.

Risk

Low -- this changes only the test entry point and test environment. Revert the commit to restore the previous runner.

Harness/evaluator governance

Upstream governance surface: N/A
Downstream EvoX impact: N/A
Rollout-local scope: N/A
Promotion boundary: N/A
Evaluator mismatch sets: N/A
Non-regression evidence: N/A
Fix-severity review: N/A
Owner approval: N/A
Security boundary: N/A
Rollback: N/A
Live promotion: no
Autonomous evaluator self-editing: no

Self-check

• If this PR adds a new source file under src/, it is registered in
  public.manifest.json consistently with its sibling files (e.g. listed
  in obfuscate when the rest of the directory is). Build verification
  passed: node scripts/build_public.js succeeded and the new file shows
  up in dist-public/ in the expected (obfuscated or plain) form.
• If this PR adds or modifies a schema factory under src/gep/schemas/,
  the corresponding validate* function is invoked at every write and
  every publish call site (not just defined).
• If this PR uses Object.assign({}, DEFAULTS, partial) to build an
  object, every reference-typed field (arrays, sub-objects) on the result
  is sliced or cloned -- not held by reference to either source.
• If this PR introduces a new module-level constant initialized from
  process.env.X, the owning module is loaded after the entry point's
  dotenv configuration step (or the constant is migrated to the lazy
  env helpers in src/config.js).
• No new runtime dependencies added without a clear justification in the
  "What changed" section above.
• Tests added or updated to cover the new behavior; full suite passes
  locally (npm test).

Related

N/A

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.