refuse test writes into the install's real data/ tree at runtime

[atomantic]

Summary

A test that writes into the developer's live data/ tree is invisible: unlike a read leak, persisting fixture bytes over their records changes nothing about whether assertions pass. #6171 was the proof — providerUsage.test.js wrote its fixture quota cards over the machine's real data/provider-quotas.json, then invalidated the sync checksum so peers pulled the fabricated values.

This closes that half at runtime, the way db.js already refuses row writes to a non-test database.

• server/lib/testDataIsolation.js throws when a write resolves inside the real data root under the test runner, naming the offending path and the createTempDataRoot() escape hatch. It fires from atomicWrite, ensureDir's create path (an existing directory is a no-op, so read-only suites stay quiet), new writeFile/appendFile/copyFile wrappers in fileCore.js, and collectionStore's record delete — so the next raw writer inherits the guard rather than having to remember an import. aiToolkit/ is untouched, per its self-containment rule.
• Inert in production, and cheaper than that: the guard module loads through a memoized await import() behind isTestRunner(), so a production process never loads it at all. The tree-wide static-import budget in importScoping.test.js is unchanged — no ceiling was raised.
• Symlinked destinations are judged at both landing sites. atomicWrite replaces a symlink; writeFile/appendFile/copyFile follow one. Checking only the link's own location would have left the guard's own hole open.

Leaks it found on its first run

Suite	What it was writing into the live install
backup.test.js	vi.doUnmock also drops the file-level vi.mock, so every later suite resolved PATHS.data to the real tree and runBackup rewrote the user's genuine data/backup/state.json on every run
providers.readiness.test.js, loraTraining/captionLeakStaging.test.js	took the machine-wide heavy-local-job claim — the file that gates the user's real local renders
sharing/integration.test.js	a hand-rolled PATHS proxy listed data/images/videos by hand, so the later-added imageRefs still pointed at data/image-refs and the importer copied bundled reference sheets there
assetHash.test.js, modelAbuseGuard.materialize.test.js	wrote fixtures into the real tree deliberately, swept up only when nothing above them threw

Each is fixed by redirecting the data root, not by silencing the guard.

Supporting changes

• isTestRunner moves out of db.js into a dependency-free lib/runtimeEnv.js. The file primitives must not pull in pg, and the many suites spelling vi.mock('../lib/db.js', () => ({ query })) were stripping it out of the module graph for every other consumer.
• lib/pathContainment.js owns root-inclusive containment and ancestor-canonicalization, kept a leaf so fileCore reaches it without dragging errorHandler/paths into every suite's closure.
• mockPathsDataRoot.js gains lazyTempDataRoot / cleanupTempDataRoots, so the vi.mock-hoisting hazard is explained once instead of in each suite that redirects a root.
• agentRunTracking.js, autonomousJobs/store.js, cosState.js, sharing/importer.js and runner.js move from raw fs writes onto the guarded primitives.

Scope, stated rather than implied

Writes only — reads stay covered by the two-run probe. Roughly forty services still reach PATHS.* with raw fs, and on a populated install their directories already exist, so ensureDir's create-path check is a no-op for them. Both limits are written into the module header rather than glossed over; the sweep is tracked separately.

Test plan

• New server/lib/testDataIsolation.test.js (22 cases) asserts the thrown message, not merely that something threw: a temp root writes fine, the real root refuses with the path and the escape hatch named, the guard is inert outside the runner, and a data-archive sibling, a .. climb, a relative path, a symlinked destination and a filesystem root all resolve correctly.
• Full server suite: 38,945 passing. Full client suite re-run. The handful of remaining failures are timeouts under load that reproduce identically on origin/main — verified against a pristine baseline worktree.
• importScoping.test.js, index.test.js (barrel/README catalogs) and the existing static testDataIsolation.guards.test.js all pass.

Closes #6176

[atomantic]

Required code review was not completed before publication. This PR is intentionally left open and will not be merged until the required review completes.

[atomantic]

Local review status

Configured reviewers for this run:claude.

• claude — completed. Returned three findings, all confirmed against the code and fixed in f612163:
  1. writeFile/appendFile/copyFile follow a symlinked destination, but the guard judged only the link's own location — a fixture symlink in a temp root could write straight through into live data. Both landing sites are now checked, resolved via readlink + canonicalizePath so a dangling link still reports its target (realpathSync throws on those).
  2. isPathAtOrInsideDir reported nothing as inside a filesystem/drive root — those already end in the separator, so the anchor compared against //.
  3. The ..-climb case in the guard's own test was vacuous: path.join normalizes its arguments, so the assertion held even with resolve() removed.

The claude reviewer's first invocation was killed by system memory pressure with no output; it was retried once and completed normally.