fix(slug): env-override runs never persist to the cwd cache; cache is GSTACK_HOME-aware

Found while closing the wave's eval gate: a test exporting
GSTACK_PROJECT_SLUG from the repo root persisted the override into the cwd
slug cache, silently rebinding the ENTIRE repo's session state (evals,
decisions, timelines) to the test's slug for every later env-less run. The
escape hatch is per-invocation by contract — it no longer writes the cache.
The cache dir also hardcoded $HOME while lib/bin-context.ts's native port
(#2561) reads it GSTACK_HOME-aware, so temp-home test runs littered the real
~/.gstack (observed: 2,528 stale temp-cwd entries, swept). Writer and reader
now key the same GSTACK_HOME-aware cache; regression tests pin both
behaviors.

Also raises the cso --diff eval budget (240s/25t → 360s/40t):
transcript-verified, the wave's legitimately-grown audit session completes
the report and dies in closing telemetry at ~215s under the old budget; the
full-audit sibling already runs at 300s.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/skill-e2e-cso.test.ts

@@ -161,9 +161,14 @@ IMPORTANT:
 - Focus on changes in the current branch vs main.
 - The webhook.ts file was added on this branch — it should be analyzed.`,
       workingDirectory: csoDiffDir,
-      maxTurns: 25,
+      maxTurns: 40,
       allowedTools: ['Bash', 'Read', 'Write', 'Edit', 'Grep', 'Glob', 'Agent'],
-      timeout: 240_000,
+      // 360s/40 turns: the v1.67 wave grew the audit session legitimately —
+      // transcript-verified, the agent finds the webhook vuln, spawns the
+      // verification subagent, and writes the report, then gets killed at
+      // ~215s in its CLOSING telemetry under the old 240s/25-turn budget.
+      // The full-audit sibling already runs at 300s.
+      timeout: 360_000,
     });
 
     logCost('cso', result);
@@ -176,7 +181,7 @@ IMPORTANT:
     ).toBe(true);
 
     recordE2E(evalCollector, 'cso-diff-mode', 'e2e-cso', result);
-  }, 240_000);
+  }, 400_000);
 });
 
 describeIfSelected('CSO v2 — infra scope', ['cso-infra-scope'], () => {