test: pin DISABLE_AUTOUPDATER in hermetic env and capture corrupt-seed warning

Both EVALS_HERMETIC branches of buildHermeticEnv now carry
DISABLE_AUTOUPDATER=1 (the allowlist scrubbed the workflow's copy, so every
PTY screen showed the updater's npm-prefix failure). Per-test overrides
still win. The corrupt durations-seed test now captures its expected
warning and restores the console spy.

test/helpers/hermetic-env.test.ts

@@ -3,7 +3,8 @@
  *
  * Pins three contracts:
  * 1. Allowlist semantics: contamination vars dropped, basics/auth/network
- *    kept, overrides merge last, EVALS_HERMETIC=0 is byte-identical legacy.
+ *    kept, overrides merge last, EVALS_HERMETIC=0 is the legacy env plus the
+ *    DISABLE_AUTOUPDATER pin.
  * 2. Seed-config shape: 20-char key suffix, trusted dirs, undefined-key safe.
  * 3. Dir lifecycle: /.claude suffix (extractPlanFilePath contract —
  *    claude-pty-runner.ts:191), sync singleton reuse, pid-aware GC.
@@ -167,7 +168,7 @@ describe('buildHermeticEnv allowlist', () => {
 });
 
 describe('EVALS_HERMETIC=0 escape hatch', () => {
-  test('returns byte-identical legacy env, overrides still last', () => {
+  test('returns the legacy env plus the updater pin, overrides still last', () => {
     const base = { ...CONTAMINATED, EVALS_HERMETIC: '0' } as NodeJS.ProcessEnv;
     const e = buildHermeticEnv(base, HERMETIC_VARS, { GSTACK_HEADLESS: '1' });
     // Legacy spread: every base var survives, hermeticVars NOT applied.
@@ -175,7 +176,7 @@ describe('EVALS_HERMETIC=0 escape hatch', () => {
     expect(e.CLAUDE_CONFIG_DIR).toBe('/Users/op/.claude');
     expect(e.GSTACK_HOME).toBe('/Users/op/.gstack');
     expect(e.GSTACK_HEADLESS).toBe('1');
-    expect(e).toEqual({ ...(base as Record<string, string>), GSTACK_HEADLESS: '1' });
+    expect(e).toEqual({ ...(base as Record<string, string>), DISABLE_AUTOUPDATER: '1', GSTACK_HEADLESS: '1' });
   });
 
   test('isHermeticEnabled reads at call time (ESM-hoist safety)', () => {

test/helpers/hermetic-env.ts

@@ -21,11 +21,15 @@
  *   └─────────────────────────────┘
  *      + per-runner extraAllow (codex: OpenAI vars; gemini: Google vars)
  *      + CLAUDE_CONFIG_DIR=<runRoot>/.claude  GSTACK_HOME=<runRoot>/gstack-home
+ *      + DISABLE_AUTOUPDATER=1 (pinned in both branches; the scrub drops the
+ *        workflow's copy and every PTY screen otherwise shows the updater's
+ *        "no write permission to npm prefix" failure)
  *      + per-test overrides spread LAST
  *
  * Escape hatch: EVALS_HERMETIC=0 restores the legacy contaminated env
- * byte-identically (runners must also gate --strict-mcp-config on
- * isHermeticEnabled() so the escape hatch restores args too).
+ * plus only the DISABLE_AUTOUPDATER pin (runners must also gate
+ * --strict-mcp-config on isHermeticEnabled() so the escape hatch restores
+ * args too).
  *
  * isHermeticEnabled() is evaluated at CALL time, never at module load —
  * ESM hoists imports above any in-file `process.env.EVALS_HERMETIC = '0'`
@@ -100,9 +104,10 @@ export function buildHermeticEnv(
   opts?: HermeticEnvOpts,
 ): Record<string, string> {
   if (!isHermeticEnabled(base)) {
-    // Escape hatch: byte-identical to the legacy spread.
+    // Escape hatch: the legacy spread plus the updater pin.
     const legacy: Record<string, string> = {};
     for (const [k, v] of Object.entries(base)) if (v !== undefined) legacy[k] = v;
+    legacy.DISABLE_AUTOUPDATER = '1';
     for (const [k, v] of Object.entries(overrides ?? {})) if (v !== undefined) legacy[k] = v;
     return legacy;
   }
@@ -127,6 +132,7 @@ export function buildHermeticEnv(
     if (allowed) out[k] = v;
   }
   if (!out.TERM) out.TERM = 'xterm-256color';
+  out.DISABLE_AUTOUPDATER = '1';
   Object.assign(out, hermeticVars);
   for (const [k, v] of Object.entries(overrides ?? {})) if (v !== undefined) out[k] = v;
   return out;