test(#2665): reversion guards for all three round-4 fixes

None of the round-4 fixes had a test that fails on reversion: re-shipping
the test-instrumentation chain passes #2858 (everything ships, so every
require resolves), dropping the strict env from test.yml demotes the guard
to report-only with nothing red, and the skillsHome derivation tests are
enumeration-relative over declarations that are all empty today. One
guard each, every one negative-controlled against its reverted fix (fails
pre-fix, passes post-fix):

- packaging-shipped-scripts-require-only-shipped.test.cjs asserts the four
  chain files are absent from the npm pack file list (reuses the tarball
  set the #2858 gate already resolves — no second npm pack).
- live-config-guard.test.cjs asserts all three test jobs wire
  GSD_STRICT_LIVE_CONFIG_GUARD, matching the WHOLE expression anchored —
  a prefix match accepted both a Windows-silently-strict tail and a
  malformed one.
- helpers-process-isolation.test.cjs cold-requires helpers.cjs in a child
  with sentinel skillsHome env vars injected into both enumerations, so
  the walk itself is under test rather than today's empty declarations.

tests/packaging-shipped-scripts-require-only-shipped.test.cjs

@@ -135,6 +135,27 @@ describe('#2858 — shipped scripts require only shipped paths', () => {
       .sort();
   });
 
+  test('#2665: the test-instrumentation chain does not ship', () => {
+    // These four are one closed require chain of test instrumentation
+    // (run-tests -> live-config-guard, affected-tests-lib -> run-tests,
+    // run-affected-tests -> affected-tests-lib). Excluding a strict subset
+    // re-trips the shipped-requires-only-shipped gate above on whichever links
+    // still ship, so the exclusion set and this assertion cover the chain.
+    const TEST_INSTRUMENTATION = [
+      'scripts/live-config-guard.cjs',
+      'scripts/run-tests.cjs',
+      'scripts/affected-tests-lib.cjs',
+      'scripts/run-affected-tests.cjs',
+    ];
+    for (const f of TEST_INSTRUMENTATION) {
+      assert.ok(
+        !shippedFiles.has(f),
+        `${f} is test instrumentation and must not ship — restore its ` +
+          "package.json files[] '!'-exclusion (and keep the whole chain excluded)",
+      );
+    }
+  });
+
   test('every shipped scripts/*.{cjs,js} is require-able from a shipped-only tree', () => {
     assert.ok(shippedScripts.length > 0, 'expected at least one shipped script');