Tests: no test process reaches real host tools or carries a real GitHub token (by design) #838

Outcome: no test process can reach this machine's real host tools or carry a real GitHub token, by design. Today that depends on each test putting the right stand-ins on its own PATH.

Why (measured by #819's round-4 review, issuecomment-6277904282):

• Tests that set their own PATH to include /usr/bin or /bin run the real binaries: gh 70 times, loginctl 26 times across 36 test files, and, on a base without Wizard: the Claude step matches the login to agent_runtime and offers an API key (#738) [PROTECTED: owner merges] #819's fix, systemctl --user show-environment and is-active 20 times each. A recorder at the front of the caller's PATH doesn't help, because the test replaces PATH.
• test/isolate.ts strips inherited WORKLANE_* variables (lines 22-24), but not GH_TOKEN, GITHUB_TOKEN or GH_ENTERPRISE_TOKEN. A token exported in the shell would reach those gh calls (inferred; unset in the measured run).
• lingerEnabled, src/os/stats.ts (systemctl show), macOS serviceRunning, and install/uninstall have no test-run guard (inferred from the code). Wizard: the Claude step matches the login to agent_runtime and offers an API key (#738) [PROTECTED: owner merges] #819 guards only serviceManagerEnv and unitActive.

Do (by design, per the owner's durability rule: a runtime refusal, not a lint):

1. test/isolate.ts removes GitHub token variables (and other credential variables the engine reads) from the test process environment.
2. In a test run (the existing test-run sign), the OS adapter's exec of host tools (systemctl, launchctl, loginctl, gh and similar) refuses unless the resolved binary is inside the test's own fake dir. Fail closed with a message naming the tool.
3. A test proves it: with the real binaries on PATH, each guarded call refuses, and nothing execs outside the test's dirs (strace or an exec recorder).

Constraints: a real (non-test) install behaves exactly as today. No exemption list without independent review (principle 9).

Related: #819, #818 (stateDir() refusal), #827, #545.