test: pin DISABLE_AUTOUPDATER in hermetic env and capture corrupt-seed warning

Both EVALS_HERMETIC branches of buildHermeticEnv now carry
DISABLE_AUTOUPDATER=1 (the allowlist scrubbed the workflow's copy, so every
PTY screen showed the updater's npm-prefix failure). Per-test overrides
still win. The corrupt durations-seed test now captures its expected
warning and restores the console spy.

test/test-free-shards.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from 'bun:test';
+import { describe, test, expect, spyOn } from 'bun:test';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -1284,16 +1284,23 @@ describe('test-free-shards: duration-aware packing (full-suite LPT)', () => {
     fs.writeFileSync(seedPath, '{ definitely not json');
     const prev = process.env.GSTACK_FREE_TEST_DURATIONS;
     process.env.GSTACK_FREE_TEST_DURATIONS = seedPath;
+    // The corrupt seed's warning is the expected output; keep it off the console.
+    const warn = spyOn(console, 'error').mockImplementation(() => {});
     try {
       expect(loadFreeTestDurations()).toBeNull();
+      expect(warn.mock.calls.map(call => String(call[0]))).toEqual([
+        expect.stringContaining(`[test:free] WARNING: corrupt durations seed ${seedPath}`),
+      ]);
       // Missing file: silent null (fresh checkouts are normal).
       process.env.GSTACK_FREE_TEST_DURATIONS = path.join(dir, 'missing.json');
       expect(loadFreeTestDurations()).toBeNull();
+      expect(warn).toHaveBeenCalledTimes(1);
       // Valid seed round-trips, non-numeric entries dropped.
       fs.writeFileSync(seedPath, JSON.stringify({ version: 1, durations: { 'test/a.test.ts': 42, bad: 'nope' } }));
       process.env.GSTACK_FREE_TEST_DURATIONS = seedPath;
       expect(loadFreeTestDurations()).toEqual({ 'test/a.test.ts': 42 });
     } finally {
+      warn.mockRestore();
       if (prev === undefined) delete process.env.GSTACK_FREE_TEST_DURATIONS;
       else process.env.GSTACK_FREE_TEST_DURATIONS = prev;
       fs.rmSync(dir, { recursive: true, force: true });