fix(#872): make roadmap-phase-fallback tests hermetic against ambient GSD env (#873)

extractCurrentMilestone reads STATE.md via planningDir(cwd), which is
workstream-aware (honours GSD_PROJECT/GSD_WORKSTREAM). The fixtures write
STATE.md to the plain <tmp>/.planning/STATE.md, so a developer shell inside a
GSD workstream (GSD_WORKSTREAM exported) redirected the read to a non-existent
workstream subdir -> version=null -> closed milestone sections leaked into the
slice and assertions failed. Clean CI/Docker env never hit it. Not a Node-26
regex bug; reproduces identically on any Node with GSD_WORKSTREAM set.

- scripts/run-tests.cjs: strip GSD_PROJECT/GSD_WORKSTREAM before spawning test
  children so the local runner env matches clean CI/Docker.
- tests/roadmap-phase-fallback.test.cjs: file-level beforeEach/afterEach
  save/delete/restore of both vars; new regression test pinning workstream-aware
  STATE.md resolution.
- tests/run-tests-harness.test.cjs: guard asserting the runner strips both vars
  (so removing the deletion fails clean CI).

Closes #872

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit a480510f54)

scripts/run-tests.cjs

@@ -236,6 +236,14 @@ function main() {
   // Build the gitignored bin/lib artifact if absent, before any test requires it.
   ensureBuiltArtifacts();
 
+  // Hermeticity: in-process tests resolve `.planning` via planningDir(cwd), which
+  // honours GSD_PROJECT/GSD_WORKSTREAM. A developer shell inside a GSD workstream
+  // exports GSD_WORKSTREAM, which would redirect fixture STATE.md reads away from
+  // each <tmp>/.planning and silently diverge from the clean CI/Docker env. Strip
+  // them so the local runner matches CI; tests that need them set them explicitly.
+  delete process.env.GSD_PROJECT;
+  delete process.env.GSD_WORKSTREAM;
+
   // Log selected files to stderr for CI / harness-test visibility.
   // node:test default reporter doesn't echo filenames, so this gives
   // operators a single stable line they can grep.