test: serialize shared credential environment state

[mnkj0021]

Fixes #278

Summary

• require the shared TEST_ENV_LOCK guard at every credential/path test helper call that mutates process-wide HOME, STORE_PATH_ENV, or CapsemPaths
• add the missing lock to the workspace-symlink credential-broker test
• serialize the trace-ID mutation in the telemetry regression test with the same shared environment lock
• split the trace-only environment guard from the credential/path guard so dropping a trace-only guard can no longer restore unrelated HOME or credential-store variables
• make the helper APIs require the lock guard, turning future unguarded helper use into a compile-time error

Validation

• cargo fmt --all -- --check
• git diff --check
• CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/gcc CC=/usr/bin/gcc cargo test -p capsem-core --lib — 1,972 passed, 0 failed
• branch is current with upstream main

AI assistance was used while preparing the change; I reviewed the final diff and test results.