test(harness): isolate source-preparation Node fixture - #309

Linked Issue

Closes #103

Chain linkage only: this source-test prerequisite does not complete #103 independently.

PR Type

• Maintenance/tooling (type:chore)

Summary

• Copy the exact installed Node24.16/Corepack/npm payload into a fresh owned prefix; preserve bytes/internal links and harden only copies.
• Run the real preparation CLI through that copy, retaining all 56 source-readmission child assertions and binding the actual copied-tool receipt.
• Keep bounded child disposal and separate source-root cleanup explicit, with owned direct-child temporary/cache settings and native lifecycle tests.

Changes

Chain Context

#296 draft / no merge
└── #297–#307 retained contract and source preparation
    └── #308 exact-pin acquisition
        └── 📍 this PR: isolated Node fixture
            └── complete private admission → runner → consumers/comparisons → cumulative CI

Immediate predecessor: #308, test/103-pinned-source-acquisition, 379c7a43795466a171eb5b4a9c00320c0ef0b008. Scope: 351 additions +2 deletions =353, including both complete new files (126+192 lines); no exception.

Start: #308's verified exact-pin acquisition and source inspector. End: public reproducible isolated tool-copy fixture plus real source-CLI integration. This reconciles the preserved fixture without carrying the Git diagnostics/test twice; those belong to #308.

Two owners remain intentional: the fixture owns its copied payload and direct-child HOME/TMP/cache; the parent claims a separate canonical source work root. Cleanup awaits fixture disposal before independently removing source work. Existing provisioning may cache under its own work/private/tmp; trusted Git keeps HOME/XDG at /nonexistent and omits temporary variables. This is not a universal descendant sandbox or cache-disabling claim.

Deferred/out of scope: complete private-runtime admission, command runner, dependency/host/MCP compatibility, cumulative Linux/macOS CI, package publication, default repin, unrelated dependency upgrades, GUI changes and protected AST apply. The trusted installed payload is copied, not newly authenticated as a distribution. Shared tool ancestry remains unchanged.

Test Plan

• Fresh local fixture lifecycle suite: 7/7, no skips; original bytes/metadata preserved, owned temporary directory and actual compile-cache DISABLED status checked.
• Current normal full suite: 103/103, zero skipped/cancelled/failed.
• Current Linux TMPDIR/TMP/TEMP alias full suite: 103/103, zero skipped/cancelled/failed; not macOS proof.
• Both full suites invoke the actual public CLI with the copied Node and check copied Corepack/private pnpm11.7 identities, all source assertions, acquisition and setup negative cases.
• Parent and SPEC reviewer independently verified both runs' real receipts and absence of both source work and copied prefixes; alias removed too.
• Final independent SPEC PASS on exact frozen bytes.
• Separate independent QUALITY APPROVED on the same frozen bytes; no findings or code corrections.
• Parent Prettier, ESLint no-fix/zero warnings, syntax, diff checks and final hash readback pass.
• Final-head push35253990928 and PR35253997764 CI succeed on ecf59cbe230920ad93074cc8376e6f5b23a8166c, with Node22.13.0 and Node24 matrices green; no reruns.

NODE_OPTIONS='' NODE_DISABLE_COMPILE_CACHE=1 node --test scripts/issue-103/node-fixture.test.mjs scripts/issue-103/acquisition.test.mjs scripts/issue-103/setup.test.mjs scripts/issue-103/prepared-source.test.mjs

Historical cache RED/GREEN and failed/interrupted unrestricted-clone evidence remain historical. Current verification does not relabel those outcomes or claim host compatibility.

Contributor Checklist

• Approved issue test(harness): define structured output schema compatibility #103 and exact predecessor test(harness): acquire exact pinned source snapshots #308 rechecked before submission.
• Exactly one type requested at creation: type:chore.
• Shellcheck/skill execution not applicable: no shell or skill files changed.
• Tests and ownership documentation travel with the fixture.
• Conventional commit ecf59cbe230920ad93074cc8376e6f5b23a8166c, without coauthor trailers.

Rollback removes this four-file fixture/integration unit only. #308's acquisition/Git error handling, source-readmission invariants, retained patches and shared process/package-manager owners remain unchanged. Keep #296 draft/no-merge; no aggregate integration approval is implied.