fix(test): isolate harness daemon runtimes

[astandrik]

What does this PR do?

Fixes #1691

Several test and security scripts inherited the caller's daemon runtime. That is unsafe for security-install.sh, which performs a real install inside a temporary home. Its activation step could stop the account daemon and disconnect MCP sessions used by an editor or coding agent.

This PR adds a shared test helper that creates a private runtime and cache before a harness invokes the product binary. It replaces inherited paths, uses protected temporary roots on each supported platform, and limits cleanup to the root created by that harness. The helper is wired into the eight security, watchdog, worker, and hook entry points covered by the issue.

The change does not touch product code, public APIs, Makefiles, workflows, dependencies, or configuration formats.

Failure before

The original reproduction started a sentinel MCP client in runtime A, then ran security-install.sh with the same inherited runtime. The install activation stopped daemon A, the frontend exited, and the daemon log recorded activation_shutdown.

Result after

The same reproduction now gives the install audit a separate runtime B. The sentinel answers a ping after the audit, daemon A keeps the same PID, and its logs contain no activation_shutdown. Runtime B is removed during cleanup.

Reproduction

The runnable fail-before reproduction is in #1691 under "Reproduction". It builds the product binary and starts a sentinel MCP client in a private runtime, so it does not touch the account daemon.

On this PR head, run the tracked pass-after contract:

bash tests/test_runtime_isolation_contract.sh

It verifies that inherited runtime and cache paths are replaced, parallel runs receive different roots, cleanup leaves the caller's runtime untouched, creation failures stop the harness before the binary starts, and security-install.sh uses a private HOME, cache, and runtime.

The live-sentinel script from #1691 can also be run against this branch. The sentinel remains connected after the install audit, daemon A keeps the same PID, and runtime A records no activation_shutdown.

Validation

• bash -n on the helper, changed harness scripts, and regression tests
• bash tests/test_runtime_isolation_contract.sh
• bash tests/test_security_fuzz_harness.sh
• seam-enabled build plus parent watchdog, worker watchdog, worker error, and hook conflict tests
• make -f Makefile.cbm security
• scripts/test.sh: 7,523 passed, 0 failed, 5 skipped on the remote Linux builder
• exact sentinel pass-after reproduction on macOS

The full scripts/lint.sh run on the remote builder reaches the existing repository-wide clang-tidy baseline in unchanged C and header files. PR CI runs scripts/lint.sh --ci, which gates this test-only diff with cppcheck and clang-format.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass
• Lint passes locally. See the clang-tidy baseline note above; the PR CI lint subset remains authoritative.
• New behavior is covered by a reproduce-first regression

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for preserving one clear invariant across the changed harnesses: no test process may inherit or affect the account daemon runtime. The shared helper plus a deterministic sentinel contract is a coherent slice even though it touches several scripts.

Because this changes executable security and test harnesses, it will receive the full script and filesystem-boundary review once the PR leaves draft. The initial patch scan found no new external dependency, outbound network path, or product-code change. Please keep the broader smoke, soak, profiling, and benchmark audit in #1696 rather than expanding this PR. The queue is full, but the draft is labeled and routed as a high-priority isolation fix.