fix(setup): isolate Codex config tests from the real Windows APPDATA

[dnlrsls]

Pre-flight Checks

• I searched open and closed issues and found no duplicate.
• I understand that a PR requires status:approved.

Bug Description

On Windows, Engram setup tests can modify the real Codex configuration under %APPDATA% even when the test isolates HOME to a temporary directory.

Production path resolution uses APPDATA for the Codex configuration path, while the affected tests isolate only HOME. The test therefore escapes its temporary home and writes test MCP configuration into the user's real roaming profile. The resulting config.toml can point at an ephemeral Go test executable and can overwrite or contaminate a valid Codex configuration.

This is independent from the Codex Stop-hook portability defect tracked in #644.

Steps to Reproduce

1. On Windows, start with a valid Codex user configuration under %APPDATA%\codex\config.toml.
2. Run the Engram setup test package containing Codex configuration tests.
3. Observe that the tests set an isolated temporary HOME but do not isolate APPDATA.
4. Observe that Codex path resolution still selects the real roaming-profile configuration.
5. Inspect the resulting Codex configuration and observe test-generated MCP state, potentially referencing an ephemeral test.test.exe path.

Do not reproduce this against a valuable profile without isolating all Windows profile variables first.

Expected Behavior

Setup tests must never read, write, replace, or delete a user's real Codex configuration.

Windows tests should isolate every environment variable used by production path resolution, including APPDATA, and assert that all resulting paths remain inside the test-owned temporary root before any filesystem mutation.

Actual Behavior

Isolating only HOME is insufficient on Windows. Production path resolution follows APPDATA, allowing a test to write outside its test root and contaminate the real Codex configuration.

Operating System

Windows

Engram Version

engram 1.20.1-0.20260720141607-763a6ba43271

Agent / Client

Codex

Relevant Logs

Observed path class: real roaming-profile Codex config
Observed test artifact: MCP command referencing an ephemeral Go test executable
Expected path class: test-owned temporary profile only

Additional Context

Proposed bounded fix

• Isolate APPDATA alongside HOME in every Windows Codex setup test.
• Prefer one shared test helper that establishes the complete platform profile used by production path resolution.
• Before mutation, assert that the resolved config path is a strict descendant of the test-owned temporary root.
• Add a regression test that seeds a sentinel real-profile path and proves it remains byte-identical after the setup test.
• Keep production Codex path semantics unchanged unless separate evidence shows they are wrong.

Privacy

This report excludes usernames, absolute home paths, private project names, hostnames, credentials, source contents, raw environment values, and internal session identifiers.