fix(test): sandbox all test filesystem and network access
- link: override HOME to temp dir instead of writing to ~/.local/bin
- beacon: mock isomorphic-git in-process instead of live GitHub clones
- explore: route 12 tests through local Bun.serve() mock server
- doctor: isolate with HOME + XDG_CONFIG_HOME env overrides
- trust-gate, vit-dir: add optional dir param to vitDir() and
dependents, eliminating process.chdir() from tests
- CLAUDE.md: add Testing Standards section (5 rules)
342/342 tests pass. No external HTTP, no real home access,
no process.chdir() in tests.