fix(#2665): derive the second config-location family instead of hand-adding it

Review round 2 named GSD_HOME and KIMI_SHARE_DIR as missing from the derived
scrub set. Both premises confirmed; the prescribed remedy is not adopted
verbatim, because adding two more literals to a four-item hand list is the
pattern that reopened this bug three times. The census the derivation
generalizes over was partial, so the census is what widens.

Two structural gaps, both closed at the source:

1. KIMI_SHARE_DIR lived inside resolveKimiHooksTomlDir's body as an inline
   descriptor, resolvable but not ENUMERABLE. Hoisted to an exported
   KIMI_HOOKS_TOML_DESCRIPTOR and collected in
   NON_REGISTRY_CONFIG_HOME_DESCRIPTORS, which TEST_ENV_BASE now derives from.
   kimi is the sharp case: it owns TWO config homes (KIMI_CONFIG_DIR, already
   registry-visible, and this one), so a registry-only derivation looks
   complete and is not.

2. GSD_HOME is a different FAMILY, not a missing registry entry. The registry
   describes where third-party runtimes keep config; GSD_HOME decides where GSD
   keeps its own user-owned state ($GSD_HOME/.gsd/ — consent.json,
   defaults.json, capability overlays), read env-first ahead of os.homedir() by
   capability-loader, capability-consent, capability-state, capability-writer,
   config-loader, install-profiles and bin/install.js. Named as
   GSD_LOCATION_ENV_KEYS rather than folded into the descriptor array, since it
   does not resolve through resolveConfigHomeFromDescriptor.

GSD_AGENTS_DIR joins the same family (round 2, Minor): env-first and
unconditional in getAgentsDir, misdirecting a read rather than a write.

A census of every env-first first-party location var — the guard-shape question
this PR owes each round — now yields exactly one remaining unguarded name,
GSD_MODEL_CATALOG, and it is dead by precedence: the co-located candidate is
index 0 and the loop breaks on first success, so the env var can only win on a
tree that is already broken, and it redirects a read even then.

Derived set: 39 -> 42 keys. resolveKimiHooksTomlDir behaviour unchanged on both
the default and the KIMI_SHARE_DIR override path.

tests/helpers.cjs

@@ -42,12 +42,22 @@ const SESSION_IDENTITY_ENV_KEYS = [
 // incapable of being narrower than the surface it guards: adding a capability
 // that declares a new configHome env var extends this set in the same commit.
 const { runtimes } = require('../gsd-core/bin/lib/capability-registry.cjs');
+const {
+  NON_REGISTRY_CONFIG_HOME_DESCRIPTORS,
+  GSD_LOCATION_ENV_KEYS,
+} = require('../gsd-core/bin/lib/runtime-homes.cjs');
 
-// Config-location vars the registry does NOT carry, each with its reader:
+// Config-location vars that are neither in the registry nor descriptor-shaped,
+// each with its reader:
 //   GROK_AGENTS_HOME — hardcoded `grok` branch in getGlobalConfigDir (src/runtime-homes.cts)
 //   GSD_RUNTIME      — selects WHICH runtime home resolves (src/model-resolver.cts)
 //   GSD_PROJECT      — planningDir() project segment (src/planning-workspace.cts)
 //   GSD_WORKSTREAM   — planningDir() workstream segment (src/planning-workspace.cts)
+//
+// #2665 round 3: this list shrinks as sources become enumerable, and that direction
+// is the point. KIMI_SHARE_DIR was NOT added here — it now derives from
+// NON_REGISTRY_CONFIG_HOME_DESCRIPTORS, because hand-adding each var a reviewer
+// names is precisely what reopened this bug three times.
 const NON_REGISTRY_CONFIG_LOCATION_ENV_KEYS = [
   'GROK_AGENTS_HOME',
   'GSD_RUNTIME',
@@ -57,7 +67,15 @@ const NON_REGISTRY_CONFIG_LOCATION_ENV_KEYS = [
 
 const CONFIG_LOCATION_ENV_KEYS = [
   ...new Set([
+    // 1. Every runtime descriptor the capability registry carries.
     ...Object.values(runtimes).flatMap((r) => r?.runtime?.configHome?.env ?? []),
+    // 2. Descriptor-shaped config homes resolved OUTSIDE the registry (kimi's
+    //    native config.toml home via KIMI_SHARE_DIR). Derived, not hand-listed.
+    ...NON_REGISTRY_CONFIG_HOME_DESCRIPTORS.flatMap((d) => d?.env ?? []),
+    // 3. GSD's OWN location vars — a different family: they decide where GSD keeps
+    //    user-owned state ($GSD_HOME/.gsd/), not where a runtime keeps its config.
+    ...GSD_LOCATION_ENV_KEYS,
+    // 4. The residue that is neither registry-carried nor descriptor-shaped.
     ...NON_REGISTRY_CONFIG_LOCATION_ENV_KEYS,
   ]),
 ].sort();