fix(test-isolation): allow-list known isolated HOMEs to stop FN-3711-style flakes

The leak guard in scripts/check-test-isolation.mjs reported
fusion-test-home-root-* dirs created by scripts/test-changed.mjs as
leaks when transient EBUSY on /var/folders prevented cleanup or the
baseline file got rotated. Track every HOME basename the script mints
and pass it via FUSION_TEST_ISOLATION_IGNORE_NAMES so the check
allow-lists them unconditionally. Surface cleanup rm failures via
console.warn instead of swallowing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/__tests__/check-test-isolation.test.mjs

@@ -49,6 +49,34 @@ test("fails when a tracked temp leak appears after baseline", () => {
   });
 });
 
+test("ignores leaked temp dirs whose basenames appear in FUSION_TEST_ISOLATION_IGNORE_NAMES", () => {
+  withFixture(({ cwd, home }) => {
+    const before = runScript(["--before"], { cwd, home });
+    assert.equal(before.status, 0);
+
+    // Simulate a fusion-test-home-root-* dir that survived cleanup. Without the
+    // env allow-list this would trip the leak guard; with it, the check passes.
+    const leakedName = `fusion-test-home-root-flake-${process.pid}`;
+    const leakedPath = path.join(tmpdir(), leakedName);
+    mkdirSync(leakedPath, { recursive: true });
+    try {
+      const result = spawnSync(process.execPath, [scriptPath], {
+        cwd,
+        env: {
+          ...process.env,
+          HOME: home,
+          USERPROFILE: home,
+          FUSION_TEST_ISOLATION_IGNORE_NAMES: leakedName,
+        },
+        encoding: "utf8",
+      });
+      assert.equal(result.status, 0, result.stderr || result.stdout);
+    } finally {
+      rmSync(leakedPath, { recursive: true, force: true });
+    }
+  });
+});
+
 test("fails when protected repo .fusion data changes after baseline", () => {
   withFixture(({ cwd, home }) => {
     const before = runScript(["--before"], { cwd, home });