fix(tests): make HOME sandboxing opt-in to avoid breaking git-dependent tests

The global HOME override in runGsdTools broke tests in verify-health.test.cjs
on Ubuntu CI: git operations fail when HOME points to a tmpDir that lacks
the runner's .gitconfig.

- runGsdTools now accepts an optional third `env` parameter (default: {})
  merged on top of process.env — no behavior change for callers that omit it
- Pass { HOME: tmpDir } only in the 6 tests that need ~/.gsd/ isolation:
  brave_api_key detection, defaults.json merging (x2), and config-new-project
  tests that assert concrete default values (x3)

tests/helpers.cjs

@@ -14,26 +14,27 @@ const TOOLS_PATH = path.join(__dirname, '..', 'get-shit-done', 'bin', 'gsd-tools
  * @param {string|string[]} args - Command string (shell-interpreted) or array
  *   of arguments (shell-bypassed via execFileSync, safe for JSON and dollar signs).
  * @param {string} cwd - Working directory.
+ * @param {object} [env] - Optional env overrides merged on top of process.env.
+ *   Pass { HOME: cwd } to sandbox ~/.gsd/ lookups in tests that assert concrete
+ *   config values that could be overridden by a developer's defaults.json.
  */
-function runGsdTools(args, cwd = process.cwd()) {
+function runGsdTools(args, cwd = process.cwd(), env = {}) {
   try {
     let result;
-    // Override HOME so buildNewProjectConfig() doesn't pick up ~/.gsd/defaults.json
-    // from the developer's machine, which would cause flaky value assertions.
-    const env = { ...process.env, HOME: cwd };
+    const childEnv = { ...process.env, ...env };
     if (Array.isArray(args)) {
       result = execFileSync(process.execPath, [TOOLS_PATH, ...args], {
         cwd,
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        env,
+        env: childEnv,
       });
     } else {
       result = execSync(`node "${TOOLS_PATH}" ${args}`, {
         cwd,
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        env,
+        env: childEnv,
       });
     }
     return { success: true, output: result.trim() };