test(setup): one answer for CODEMAN_DATA_DIR, the strip from #371

#356 and #371 fixed the same leak two ways. #356 pointed CODEMAN_DATA_DIR at a
second throwaway directory and cleaned it up in afterAll and on exit; #371
deletes the variable along with CODEMAN_INSTANCE and CODEMAN_TMUX_SOCKET, so
`getDataDir()` falls back to `homedir()`, which the temp HOME already redirects.
Merged as they were, setup.ts set the variable and deleted it a few lines
later, and the second directory was created for nothing.

The strip wins: same protection, one tree to clean up, and the isolation test
#371 adds pins the list statically. The extra directory, its restore and its
two rmSync calls go, the vitest config `env` entries that set the same variable
go (they were documented as inert and would now be contradicted by the setup
file either way), the two test comments that described the old mechanism are
reworded, and CLAUDE.md's testing paragraph names the three stripped variables
and why CODEMAN_INSTANCE has to be stripped in the setup file rather than a hook.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qg6bcATm1pNNY4kQWGwzgu

test/routes/session-routes-workspace-hooks.test.ts

@@ -169,8 +169,9 @@ describe('POST /api/sessions workspace hooks', () => {
     // as a junk directory under the server cwd. statusLineTelemetry rides along:
     // applyStatusLineConfig mkdirs the same way and used to run for remote attaches.
     // SAFETY (2026-08-29): write straight to `getDataDir()` — `test/setup.ts`
-    // already sandboxes CODEMAN_DATA_DIR for the whole file (same convention as
-    // the docker-hosts fixtures below). A prior version of this test stubbed
+    // already sandboxes the data dir for the whole file (temp HOME, inherited
+    // CODEMAN_DATA_DIR stripped; same convention as the docker-hosts fixtures
+    // below). A prior version of this test stubbed
     // CODEMAN_DATA_DIR to a SEPARATE throwaway dir for just this write, but
     // `session-routes.ts`'s `CODEMAN_CONFIG_DIR` is a module-load-time constant
     // (frozen at the sandboxed dir before this test ever runs), so that fixture