fix(test): scope rendered-output tripwires to repo sources; stop cdp-e2e's env leak

Two hermeticity holes surfaced by the wave's final gate. (1) The three T6
tripwires (branch-slug, codex-flag, empty-find) enumerated the whole tree
including the workspace-local .claude/ install, which is not generated
output and can carry dangling symlinks from unrelated sessions — one ENOENT
there failed all three. They now scan repo sources only. (2)
browse/test/cdp-e2e.test.ts mutated process.env.GSTACK_HOME at module scope
without restore; in one-process shard runs that leaks into every later test
file — observed baking cdp-e2e's temp render path into artifacts that
outlived it (53 dangling SKILL.md symlinks in a workspace install). The
original value is now restored in afterAll. The exact test that performed
the polluted relink remains unattributed; both known leak vectors are
closed and the workspace was repaired via an explicit gstack-relink.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/branch-slug-hygiene.test.ts

@@ -36,7 +36,7 @@ const FILENAME_PREFIX = /\$\{?_BRANCH\}?[A-Za-z0-9._-]*\.(?:jsonl|json|md|txt|lo
 
 function renderedSkillFiles(): string[] {
   const out = execSync(
-    `find "${ROOT}" -name 'SKILL.md' -not -path '*/node_modules/*' ; find "${ROOT}" -path '*/sections/*.md' -not -path '*/node_modules/*'`,
+    `find "${ROOT}" -name 'SKILL.md' -not -path '*/node_modules/*' -not -path '*/.claude/*' ; find "${ROOT}" -path '*/sections/*.md' -not -path '*/node_modules/*' -not -path '*/.claude/*'`,
     { encoding: 'utf-8' },
   );
   return out.split('\n').filter(Boolean);

test/codex-web-search-flag.test.ts

@@ -29,6 +29,9 @@ function grepRepo(pattern: string, includes: string[]): string[] {
     .split('\n')
     .filter(Boolean)
     .filter((f) => !f.includes('node_modules'))
+    // The workspace-local .claude/ install is not generated output and can
+    // carry dangling symlinks from unrelated sessions.
+    .filter((f) => !f.includes('/.claude/'))
     .filter((f) => !f.endsWith('test/codex-web-search-flag.test.ts'));
 }
 

test/empty-find-fallthrough.test.ts

@@ -86,7 +86,10 @@ describe('empty find must not fall through to cwd (#2483)', () => {
     const hits = out
       .split('\n')
       .filter(Boolean)
-      .filter((f) => !f.includes('node_modules'));
+      .filter((f) => !f.includes('node_modules'))
+    // The workspace-local .claude/ install is not generated output and can
+    // carry dangling symlinks from unrelated sessions.
+    .filter((f) => !f.includes('/.claude/'));
     expect(hits).toEqual([]);
   });
 });