fix(tests): repair 7 pre-existing failures (env pollution + stale markers)

All 7 failures existed on main before this branch — verified via `git stash`
round-trip. Bundling them into the long-lived-sidebar PR because we kept
tripping over them while running `bun test` to verify Commit 0.

  * Global afterEach restores `process.env.PATH` (new bunfig.toml +
    test-setup.ts). browser-skill-commands.test.ts sets
    `PATH = '/test/bin:/usr/bin'` to exercise a scrubbed-env fixture and
    used the broken `process.env = origEnv` reassignment pattern that
    swaps the proxy reference; the underlying env stayed mutated and
    leaked downstream. Fixed three call sites in that file and added a
    narrow PATH-only global guardrail so a future polluter can't bring
    the bug back. Killed: pair-agent-tunnel-eval (bun ENOENT),
    security.test.ts > resolveBashBinary (Bun.which('bash') null),
    server-no-import-side-effects (bun ENOENT).
  * server-auth.test.ts: two `sliceBetween` markers referenced strings
    deleted when sidebar-agent.ts was ripped — `'Sidebar agent started'`
    → `'Terminal agent started'`, `'Sidebar endpoints'` → `'Batch endpoint'`.
    Also fixed the pair-agent BROWSE_PARENT_PID assertion (the literal
    `serverEnv.BROWSE_PARENT_PID` never existed in source; the actual
    contract is the object-literal `BROWSE_PARENT_PID: '0'` inside the
    `const serverEnv` declaration).
  * test/upgrade-migration-v1.test.ts: also overrides HOME in the spawn
    env. The migration shells out to `${HOME}/.claude/skills/gstack/bin/gstack-config`
    and a developer's real config with `explain_level` set causes the
    script to take the "user already decided" branch and skip writing
    the pending-prompt flag the test asserts on.
  * test/setup-codesign.test.ts: replaced fragile `bun run build`
    string-match (which hit a comment 700 lines later) with the actual
    invocation `bun_cmd run build` used in the setup script.

Net: full suite is now green; CI no longer trips on bash/bun-ENOENT
from PATH pollution or on test markers that drifted with the codebase.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test/setup-codesign.test.ts

@@ -33,9 +33,12 @@ describe('setup: Apple Silicon codesign', () => {
 
   test('codesign block is inside the NEEDS_BUILD=1 branch', () => {
     const content = fs.readFileSync(SETUP_SCRIPT, 'utf-8');
-    // The codesign block should appear after `bun run build` and before the
-    // `if [ ! -x "$BROWSE_BIN" ]` guard that checks the build succeeded.
-    const buildIdx = content.indexOf('bun run build');
+    // The codesign block should appear after the build command and before the
+    // `if [ ! -x "$BROWSE_BIN" ]` guard that checks the build succeeded. The
+    // setup script invokes the build via `bun_cmd run build` (not literal
+    // `bun run build`) so the wrapper can route through asdf/volta/etc;
+    // matching the wrapped form keeps this test stable across that indirection.
+    const buildIdx = content.indexOf('bun_cmd run build');
     const codesignIdx = content.indexOf('codesign --remove-signature');
     const browseCheckIdx = content.indexOf('gstack setup failed: browse binary missing');
     expect(buildIdx).toBeGreaterThan(-1);

test/upgrade-migration-v1.test.ts

@@ -26,9 +26,13 @@ afterEach(() => {
 });
 
 function run(): { stdout: string; stderr: string; status: number } {
+  // Override HOME too — the migration reads `${HOME}/.claude/skills/gstack/bin/gstack-config`,
+  // and the developer's real config may have `explain_level` set, which the
+  // migration interprets as "user already decided" and short-circuits without
+  // writing the pending-prompt flag (breaking these tests).
   const res = spawnSync('bash', [MIGRATION], {
     encoding: 'utf-8',
-    env: { ...process.env, GSTACK_HOME: tmpHome },
+    env: { ...process.env, GSTACK_HOME: tmpHome, HOME: tmpHome },
   });
   return {
     stdout: (res.stdout ?? '').trim(),