test: enforce test-directory isolation across all packages

Introduce a shared test-utils module and global vitest setup that
guarantee tests never write to the real .fusion directory or leak temp
directories under /tmp.

Infrastructure:
- packages/core/src/__test-utils__/workspace.ts — tempWorkspace(),
  useIsolatedCwd(), trackForCleanup(), assertOutsideRealFusion() with
  auto-cleanup in afterEach.
- packages/core/src/__test-utils__/vitest-setup.ts — per-worker guard:
  chdirs each worker into an isolated tmp dir, wraps process.chdir to
  refuse the real .fusion, scopes tmp dirs under fusion-test-workers/
  (skips cwd change in thread-pool workers where chdir isn't supported).
- packages/core/src/__test-utils__/vitest-teardown.ts — globalSetup
  hook that wipes the shared parent even when workers are SIGKILLed.
- scripts/check-test-isolation.mjs + `test:isolated` / `test:check-
  isolation` scripts for CI.
- @fusion/test-utils alias + setupFiles + globalSetup wired into core,
  cli, engine, dashboard, tui vitest configs; matching tsconfig paths.

Test refactors (no behavior change):
- cli provider-settings, auth-paths, provider-auth — switch leaking
  mkdtempSync calls to tempWorkspace().
- core migration, first-run, store-backward-compat — replace manual
  process.chdir save/restore with useIsolatedCwd().
- tui fusion-context — replace 9 hardcoded tmp paths (collision-prone
  under parallelism) with tempWorkspace().
- dashboard useTheme, FileBrowser, TaskCard — resolve source-file reads
  against a PACKAGE_ROOT computed from import.meta.url instead of cwd,
  so tests don't depend on the process working directory.

Verified: full suite (~15,500 tests across 8 packages + plugins) passes
and the orphan-detector reports zero leaked temp directories after a
complete run.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/core/src/__tests__/first-run.test.ts

@@ -1,16 +1,11 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { realpath } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, basename } from "node:path";
+import { join } from "node:path";
+import { tempWorkspace } from "@fusion/test-utils";
 import { FirstRunExperience, createFirstRunExperience } from "../first-run.js";
 import { CentralCore } from "../central-core.js";
 
-// Helper to create a temp directory
-function createTempDir(): string {
-  return mkdtempSync(join(tmpdir(), "kb-first-run-test-"));
-}
-
 // Helper to create a fake kb project structure
 function createFakeKbProject(dir: string): void {
   mkdirSync(join(dir, ".fusion"), { recursive: true });
@@ -24,7 +19,7 @@ describe("FirstRunExperience", () => {
   let originalCwd: string;
 
   beforeEach(async () => {
-    tempDir = createTempDir();
+    tempDir = tempWorkspace("kb-first-run-test-");
     centralCore = new CentralCore(tempDir);
     await centralCore.init();
     // Create GlobalSettingsStore with temp directory for isolation
@@ -38,7 +33,6 @@ describe("FirstRunExperience", () => {
   afterEach(() => {
     try {
       process.chdir(originalCwd);
-      rmSync(tempDir, { recursive: true, force: true });
     } catch {
       // Ignore cleanup errors
     }

packages/core/src/__tests__/store-backward-compat.test.ts

@@ -1,16 +1,11 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from "node:fs";
+import { mkdirSync, rmSync, existsSync } from "node:fs";
 import { DatabaseSync } from "node:sqlite";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { tempWorkspace } from "@fusion/test-utils";
 import { TaskStore } from "../store.js";
 import { CentralCore } from "../central-core.js";
 
-// Helper to create a temp directory
-function createTempDir(): string {
-  return mkdtempSync(join(tmpdir(), "kb-compat-test-"));
-}
-
 // Helper to create a fake fusion project structure for the current store implementation
 function createFakeFusionProject(dir: string): void {
   const fusionDir = join(dir, ".fusion");
@@ -26,7 +21,7 @@ describe("TaskStore Backward Compatibility", () => {
   let originalCwd: string;
 
   beforeEach(async () => {
-    tempDir = createTempDir();
+    tempDir = tempWorkspace("kb-compat-test-");
     centralCore = new CentralCore(tempDir);
     await centralCore.init();
     originalCwd = process.cwd();
@@ -36,7 +31,6 @@ describe("TaskStore Backward Compatibility", () => {
     try {
       process.chdir(originalCwd);
       await centralCore.close();
-      rmSync(tempDir, { recursive: true, force: true });
     } catch {
       // Ignore cleanup errors
     }
@@ -187,13 +181,13 @@ describe("TaskStore Backward Compatibility", () => {
       await store.init();
 
       expect(store).toBeInstanceOf(TaskStore);
-      
+
       // Should be able to create tasks
       const task = await store.createTask({
         description: "Test task",
         column: "triage",
       });
-      
+
       expect(task.id).toBeDefined();
       expect(task.description).toBe("Test task");
     });