fix(tests): make HOME sandboxing opt-in to avoid breaking git-dependent tests

The global HOME override in runGsdTools broke tests in verify-health.test.cjs
on Ubuntu CI: git operations fail when HOME points to a tmpDir that lacks
the runner's .gitconfig.

- runGsdTools now accepts an optional third `env` parameter (default: {})
  merged on top of process.env — no behavior change for callers that omit it
- Pass { HOME: tmpDir } only in the 6 tests that need ~/.gsd/ isolation:
  brave_api_key detection, defaults.json merging (x2), and config-new-project
  tests that assert concrete default values (x3)

tests/config.test.cjs

@@ -83,7 +83,7 @@ describe('config-ensure-section command', () => {
     fs.mkdirSync(gsdDir, { recursive: true });
     fs.writeFileSync(path.join(gsdDir, 'brave_api_key'), 'test-key', 'utf-8');
 
-    const result = runGsdTools('config-ensure-section', tmpDir);
+    const result = runGsdTools('config-ensure-section', tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);
@@ -100,7 +100,7 @@ describe('config-ensure-section command', () => {
       commit_docs: false,
     }), 'utf-8');
 
-    const result = runGsdTools('config-ensure-section', tmpDir);
+    const result = runGsdTools('config-ensure-section', tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);
@@ -119,7 +119,7 @@ describe('config-ensure-section command', () => {
       workflow: { research: false },
     }), 'utf-8');
 
-    const result = runGsdTools('config-ensure-section', tmpDir);
+    const result = runGsdTools('config-ensure-section', tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);
@@ -330,7 +330,7 @@ describe('config-new-project command', () => {
       model_profile: 'balanced',
       workflow: { research: true, plan_check: true, verifier: true, nyquist_validation: true },
     });
-    const result = runGsdTools(['config-new-project', choices], tmpDir);
+    const result = runGsdTools(['config-new-project', choices], tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);
@@ -378,7 +378,7 @@ describe('config-new-project command', () => {
       model_profile: 'quality',
       workflow: { research: false, plan_check: false, verifier: true, nyquist_validation: false },
     });
-    const result = runGsdTools(['config-new-project', choices], tmpDir);
+    const result = runGsdTools(['config-new-project', choices], tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);
@@ -397,7 +397,7 @@ describe('config-new-project command', () => {
   });
 
   test('works with empty choices — all defaults materialized', () => {
-    const result = runGsdTools(['config-new-project', '{}'], tmpDir);
+    const result = runGsdTools(['config-new-project', '{}'], tmpDir, { HOME: tmpDir });
     assert.ok(result.success, `Command failed: ${result.error}`);
 
     const config = readConfig(tmpDir);

tests/helpers.cjs

@@ -14,26 +14,27 @@ const TOOLS_PATH = path.join(__dirname, '..', 'get-shit-done', 'bin', 'gsd-tools
  * @param {string|string[]} args - Command string (shell-interpreted) or array
  *   of arguments (shell-bypassed via execFileSync, safe for JSON and dollar signs).
  * @param {string} cwd - Working directory.
+ * @param {object} [env] - Optional env overrides merged on top of process.env.
+ *   Pass { HOME: cwd } to sandbox ~/.gsd/ lookups in tests that assert concrete
+ *   config values that could be overridden by a developer's defaults.json.
  */
-function runGsdTools(args, cwd = process.cwd()) {
+function runGsdTools(args, cwd = process.cwd(), env = {}) {
   try {
     let result;
-    // Override HOME so buildNewProjectConfig() doesn't pick up ~/.gsd/defaults.json
-    // from the developer's machine, which would cause flaky value assertions.
-    const env = { ...process.env, HOME: cwd };
+    const childEnv = { ...process.env, ...env };
     if (Array.isArray(args)) {
       result = execFileSync(process.execPath, [TOOLS_PATH, ...args], {
         cwd,
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        env,
+        env: childEnv,
       });
     } else {
       result = execSync(`node "${TOOLS_PATH}" ${args}`, {
         cwd,
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        env,
+        env: childEnv,
       });
     }
     return { success: true, output: result.trim() };