fix(test): unique tmp dirs for plan artifacts + audited live-repo cwd sites

Six paid PTY tests wrote their expected plan artifact to a FIXED shared
/tmp path ('/tmp/gstack-test-plan-<mode>.md') and rmSync'd it in
finally — under --retry 1, EVALS_JOBS>1, or two concurrent worktrees, a
sibling's cleanup deletes this run's artifact and the D19 'agent did
not produce expected plan file' assertion fires spuriously. Each test
now mkdtemps its own dir, interpolates the unique path into the agent
prompt (fixture-sourced prompts get a replaceAll + drift guard that
throws if the fixture's literal ever moves), and cleans up its own dir.

The 18 cwd:-into-the-live-repo sites were audited: all deliberate
(skill registry + hermetic pre-trusted dir, in-repo gen renders, git
history reads, slug resolution) — each now carries a
'// LIVE-REPO CWD: <reason>' comment so the next audit can tell
deliberate from accidental.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/skill-e2e-opus-47.test.ts

@@ -67,6 +67,8 @@ function mkEvalRoot(suffix: string, includeOverlay: boolean): string {
   const result = spawnSync(
     'bun',
     ['run', 'scripts/gen-skill-docs.ts', '--model', includeOverlay ? 'opus-4-7' : 'claude'],
+    // LIVE-REPO CWD: gen-skill-docs reads .tmpl sources and regenerates the
+    // in-repo SKILL.md files (restored to default in afterAll below).
     { cwd: ROOT, stdio: 'pipe', encoding: 'utf-8', timeout: 60_000 },
   );
   if (result.status !== 0) {
@@ -169,6 +171,8 @@ describeE2E('Opus 4.7 overlay behavior evals', () => {
     // whichever model ran last. Reset to the default (claude) so the tree
     // matches what would be checked in.
     spawnSync('bun', ['run', 'scripts/gen-skill-docs.ts'], {
+      // LIVE-REPO CWD: restores the in-repo SKILL.md files to the default
+      // model render after mkEvalRoot's --model regens.
       cwd: ROOT,
       stdio: 'pipe',
       timeout: 60_000,