test(#2126): fix os.tmpdir() cross-file race + dedup folds surfaced by gsd-test (no-defer)

Phase 3's gsd-test surfaced 8 pre-existing test-isolation races (in #2090's test
files now on next). Per CLAUDE.md's no-defer rule these are fixed inline in the
current change. Root-caused via /qa-test-architect — all bad-test (the
rewrite-engine production code is race-free):

- install-runtime-artifacts.test.cjs: the "rmSync when readFileSync throws" test
  diffed the SHARED os.tmpdir() for gsd-cmd-rewrites-* dirs and force-deleted any
  new one with no ownership check. Under --test-concurrency it deleted a sibling
  test file's LIVE tempDir mid-copy (the #1575 "ENOENT .../graphify.md") and
  misattributed it as its own leak. Fixed: capture the exact tempDir THIS call
  creates (fs.mkdtempSync monkeypatch, restored in finally) and assert only on
  that — never sweep/delete the shared os.tmpdir(). Also deduped the enh-1511
  block the #1969 consolidation folded in 3x byte-identically (#1970/#1974/#1975)
  down to 1 copy; 308 unique test titles unchanged (verified).
- issue-1575-agent-descriptor-parity.test.cjs: a missing }); nested the M2
  'cursor attribution' test inside the per-runtime loop so it ran 7x (widening
  the tempDir window). Fixed the brace -> runs once as a describe sibling.
- config-get-default.test.cjs: local run()/runRaw() spawned node via
  execFileSync with a fixed 5s timeout and no retry -> ETIMEDOUT under Docker
  load. Redesigned to call cmdConfigGet in-process (fs.writeSync fd-capture +
  process.exit sentinel, both restored in finally) — no subprocess, no wall clock.
- runtime-artifact-conversion.cts: fixed the stale "No production caller today"
  JSDoc on rewriteStagedCommandBodies (real callers: applySurface,
  createRuntimeArtifactInstallPlan) — the false doc invited the bad test.

Refs #2126, #2090

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/runtime-artifact-conversion.cts

@@ -2522,10 +2522,12 @@ function rewriteStagedSkillBodies(stagedDir, opts) {
  * attribution from opts, then delegates to applyRuntimeContentRewritesForCommandsInPlace
  * (single copy+rewrite owner).
  *
- * @internal — symmetric companion to rewriteStagedSkillBodies; retained as the deep-seam
- * API for command bodies. No production caller today (install rewrites commands via
- * copyWithPathReplacement → applyRuntimeContentRewritesForCommandsInPlace). Kept for
- * API symmetry + test coverage.
+ * @internal — symmetric companion to rewriteStagedSkillBodies; the deep-seam API for
+ * command bodies. Production callers: applySurface (surface.cts) and the install path
+ * in createRuntimeArtifactInstallPlan (runtime-artifact-install-plan.cts) — both keep
+ * the returned temp dir alive until they have copied its contents out, then clean it up
+ * in their own finally. (A test that treats this as a throwaway shared-tmp path will
+ * race those live temp dirs under --test-concurrency; see #1575/#2090.)
  *
  * @returns {string} path to the temp dir (caller is responsible for cleanup)
  */