feat(FN-3593): add test isolation CI enforcement, fix stuck-requeue race, a

This merge lands five FN-3593 commits establishing a test isolation contract with a new `scripts/check-test-isolation.mjs` guard that scans for accidental `beforeEach`/`afterEach`/`beforeAll`/`afterAll` in setup helpers, plus per-package `setup-test-isolation.ts` bootstraps that canonicalize the pat

Fusion-Task-Id: FN-3593

scripts/__tests__/check-test-isolation.test.mjs

@@ -0,0 +1,84 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const scriptPath = path.resolve("scripts/check-test-isolation.mjs");
+
+function withFixture(fn) {
+  const cwd = mkdtempSync(path.join(tmpdir(), "check-isolation-cwd-"));
+  const home = mkdtempSync(path.join(tmpdir(), "check-isolation-home-"));
+  mkdirSync(path.join(cwd, ".fusion"), { recursive: true });
+  mkdirSync(path.join(home, ".fusion"), { recursive: true });
+  try {
+    fn({ cwd, home });
+  } finally {
+    rmSync(cwd, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+}
+
+function runScript(args, options) {
+  return spawnSync(process.execPath, [scriptPath, ...args], {
+    cwd: options.cwd,
+    env: { ...process.env, HOME: options.home, USERPROFILE: options.home },
+    encoding: "utf8",
+  });
+}
+
+test("passes when baseline and current state match", () => {
+  withFixture(({ cwd, home }) => {
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+    const after = runScript([], { cwd, home });
+    assert.equal(after.status, 0);
+  });
+});
+
+test("fails when a tracked temp leak appears after baseline", () => {
+  withFixture(({ cwd, home }) => {
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+    mkdirSync(path.join(tmpdir(), "fusion-test-leak-check-script"), { recursive: true });
+    const after = runScript([], { cwd, home });
+    assert.equal(after.status, 1);
+    assert.match(after.stderr, /leaked temp director/i);
+    rmSync(path.join(tmpdir(), "fusion-test-leak-check-script"), { recursive: true, force: true });
+  });
+});
+
+test("fails when protected repo .fusion data changes after baseline", () => {
+  withFixture(({ cwd, home }) => {
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+    writeFileSync(path.join(cwd, ".fusion", "mutated.txt"), "x");
+    const after = runScript([], { cwd, home });
+    assert.equal(after.status, 1);
+    assert.match(after.stderr, /protected live \.fusion data changed/i);
+  });
+});
+
+test("fails when protected HOME .fusion data changes after baseline", () => {
+  withFixture(({ cwd, home }) => {
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+    writeFileSync(path.join(home, ".fusion", "home-mutated.txt"), "x");
+    const after = runScript([], { cwd, home });
+    assert.equal(after.status, 1);
+    assert.match(after.stderr, /protected live \.fusion data changed/i);
+  });
+});
+
+test("fails when protected .fusion existence changes after baseline", () => {
+  withFixture(({ cwd, home }) => {
+    rmSync(path.join(cwd, ".fusion"), { recursive: true, force: true });
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+    mkdirSync(path.join(cwd, ".fusion"), { recursive: true });
+    const after = runScript([], { cwd, home });
+    assert.equal(after.status, 1);
+    assert.match(after.stderr, /protected live \.fusion data changed/i);
+  });
+});

scripts/__tests__/test-changed.test.mjs

@@ -17,6 +17,7 @@ import {
   applyCacheToPlan,
   recordCachePass,
   cacheFilePath,
+  shouldRunIsolationGuard,
 } from "../test-changed.mjs";
 
 import { mkdirSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
@@ -91,6 +92,10 @@ test("shouldForceFullSuite: returns true when scripts/test-changed.mjs changed",
   assert.equal(shouldForceFullSuite(["scripts/test-changed.mjs"]), true);
 });
 
+test("shouldForceFullSuite: returns true when scripts/check-test-isolation.mjs changed", () => {
+  assert.equal(shouldForceFullSuite(["scripts/check-test-isolation.mjs"]), true);
+});
+
 test("shouldForceFullSuite: returns true when a GitHub workflow changed", () => {
   assert.equal(shouldForceFullSuite([".github/workflows/ci.yml"]), true);
 });
@@ -550,3 +555,11 @@ test("cacheFilePath: ends with .fusion/test-cache.json", () => {
   const p = cacheFilePath();
   assert.ok(p.endsWith(path.join(".fusion", "test-cache.json")), `got: ${p}`);
 });
+
+test("shouldRunIsolationGuard: enabled by default", () => {
+  assert.equal(shouldRunIsolationGuard({}), true);
+});
+
+test("shouldRunIsolationGuard: disabled when env flag is set", () => {
+  assert.equal(shouldRunIsolationGuard({ FUSION_TEST_DISABLE_ISOLATION_GUARD: "1" }), false);
+});