test(setup): one answer for CODEMAN_DATA_DIR, the strip from #371

#356 and #371 fixed the same leak two ways. #356 pointed CODEMAN_DATA_DIR at a
second throwaway directory and cleaned it up in afterAll and on exit; #371
deletes the variable along with CODEMAN_INSTANCE and CODEMAN_TMUX_SOCKET, so
`getDataDir()` falls back to `homedir()`, which the temp HOME already redirects.
Merged as they were, setup.ts set the variable and deleted it a few lines
later, and the second directory was created for nothing.

The strip wins: same protection, one tree to clean up, and the isolation test
#371 adds pins the list statically. The extra directory, its restore and its
two rmSync calls go, the vitest config `env` entries that set the same variable
go (they were documented as inert and would now be contradicted by the setup
file either way), the two test comments that described the old mechanism are
reworded, and CLAUDE.md's testing paragraph names the three stripped variables
and why CODEMAN_INSTANCE has to be stripped in the setup file rather than a hook.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qg6bcATm1pNNY4kQWGwzgu

config/vitest.ci.config.ts

@@ -23,13 +23,6 @@ export default defineConfig({
     include: ['test/**/*.test.ts'],
     exclude: [...configDefaults.exclude, ...NON_CI_TEST_GLOBS],
     setupFiles: ['./test/setup.ts'],
-    // SAFETY: force every worker's data dir away from prod `~/.codeman`. Route
-    // tests (e.g. session-routes-workspace-hooks) write remote-hosts.json into
-    // `getDataDir()`; without this a bare run clobbers the production host
-    // registry (found 2026-08-29). `/tmp` is fine here — the tree is throwaway.
-    env: {
-      CODEMAN_DATA_DIR: '/tmp/codeman-vitest-data',
-    },
     fileParallelism: false,
     testTimeout: 30000,
     teardownTimeout: 60000,

config/vitest.config.ts

@@ -21,13 +21,6 @@ export default defineConfig({
     environment: 'node',
     include: ['test/**/*.test.ts'],
     setupFiles: ['./test/setup.ts'],
-    // SAFETY: force every worker's data dir away from prod `~/.codeman`. Route
-    // tests (e.g. session-routes-workspace-hooks) write remote-hosts.json into
-    // `getDataDir()`; without this a bare run clobbers the production host
-    // registry (found 2026-08-29). `/tmp` is fine here — the tree is throwaway.
-    env: {
-      CODEMAN_DATA_DIR: '/tmp/codeman-vitest-data',
-    },
     // Run test files sequentially to respect mux session limits
     // Individual tests within files still run in parallel where safe
     fileParallelism: false,