Fix shell sync test database isolation

[andrei-hasna]

Remediation cycle 2 for Instructions issue #65 and Todos task 31be7110-db3a-4529-acf9-e08009af3e4c.

Scope: test-only fix in src/lib/sync.test.ts.

Changes:

• Pass an explicit tmpDir database path to syncAndApplyBashProfile so the shell-profile regression bypasses the managed API-routing guard through the package-supported test path.

Verification:

• bun run test src/lib/sync.test.ts -t "syncKnown shell source safety"
• bun run test
• bun run typecheck
• bun run build
• git diff --check
• gitleaks protect --staged --redact --no-banner

Refs #65.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW-RECHECK] NO_GO — instructions issue #65 PR #75 @ 5bef366 — same reviewer account014 — remediation cycle 2 FINAL.

Focused final recheck only. Raw stdout/stderr/rc captures are mode 600 under /tmp/instructions-65-final-recheck.g2kXOc.

Exact PR/head evidence:

• Local git rev-parse HEAD rc=0: 5bef3669e4debdd587d4da63e44960bfca757606
• Local git rev-parse HEAD^{tree} rc=0: eaa0e0d73b82f73db7244e8aee722d6061be29ac
• Local git rev-parse HEAD^ rc=0: 9fe30cce5bf14786db4bd2001f046bbfc00cb405
• gh pr view 75 --json ... rc=0: state:"OPEN", isDraft:true, headRefOid:"5bef3669e4debdd587d4da63e44960bfca757606", baseRefOid:"9fe30cce5bf14786db4bd2001f046bbfc00cb405"
• Remote checks at that head: build (ubuntu-latest) SUCCESS, build (macos-latest) SUCCESS, [code]smith SKIPPED
• gh pr diff 75 rc=0: one file, src/lib/sync.test.ts, one-line change const db = getDatabase(join(tmpDir, "instructions-test.db"));

Named gates:

• bun run test src/lib/sync.test.ts -t "syncKnown shell source safety" rc=0. Safe actual lines: (pass) syncKnown shell source safety > guards the optional local env helper when it is absent; (pass) syncKnown shell source safety > preserves local env initialization when the helper is present; 2 pass; 0 fail; Ran 2 tests across 1 file.
• bun run test src/lib/sync.test.ts rc=1. Safe actual lines: error: instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.; (fail) syncFromDir > adds new files from disk; (fail) syncFromDir > unchanged files are not updated; (fail) syncFromDir > updated files are detected; (fail) syncFromDir > dry-run does not write to DB; (fail) syncFromDir > returns skipped for missing dir; (fail) diffConfig > returns identical message when same; (fail) diffConfig > returns diff for different content; (fail) diffConfig > returns file not found for missing path; (fail) diffConfig > diff includes transformed output paths; (fail) syncToDisk > skips stale retired Gemini and session-owned Antigravity rows; 18 pass; 10 fail; error: script "test" exited with code 1.
• bun run typecheck rc=0. Safe actual line: $ tsc --noEmit.
• git diff --check rc=0, stdout empty, stderr empty.
• git status --short rc=0, stdout empty, stderr empty.

Open finding:

• NO_GO, final cycle stop. The named focused two-test blocker is fixed, but the required full affected-file gate still fails in the same ambient managed environment: ten other tests in src/lib/sync.test.ts still reach the API-routing getDatabase() guard without an explicit local test database path. This is a concrete remaining affected-gate failure; no further remediation cycle is started.