perf(test): reduce redundant CLI subprocess startup

[Astro-Han]

Part of #2382.

Problem

CLI, Headless CLI, and harness A/B CLI tests repeatedly start Node processes for scenarios whose semantics can be exercised through existing in-process entry points.

Real subprocess coverage remains necessary for process-level behavior, but not every scenario needs to pay that cost.

Outcome

• Test ordinary command semantics in process.
• Retain representative subprocess coverage for stdin, stdout, exit codes, signals, persistence, detached execution, and fail-closed behavior.
• Keep CLI and Headless changes in separate PRs.
• Do not change production command behavior.

Each PR must identify the retained process contracts and include comparable before/after timing.

[UncertaintyDeterminesYou4ndMe]

I'll take this one, continuing from the #2389 series.

Plan per the issue outcome list:

1. Inventory every test that spawns a Node subprocess across CLI, Headless CLI, and harness A/B CLI suites, and classify each as (a) exercising a genuine process-level contract — stdin wiring, stdout/stderr framing, exit codes, signals, persistence across process death, detached execution, fail-closed — or (b) exercising ordinary command semantics that an existing in-process entry point already covers.
2. Move class (b) scenarios in process; keep representative subprocess coverage for every class (a) contract and name the retained contracts in the PR.
3. Separate PRs for CLI and Headless, each with comparable before/after timing.

No production command behavior changes.

[UncertaintyDeterminesYou4ndMe]

Both workspace PRs are up:

• test(cli): run ordinary run-command semantics in process #2476 — CLI: run-command.test.ts ordinary semantics through the injectable MakaRunDeps seam. 15.06s → 3.60s (−76%), spawns 29 → 6. Retained: piped stdin ×3, SIGINT → 130 ×2, fail-closed sandbox boundary ×1.
• test(headless): run ordinary CLI command semantics in process #2479 — Headless: cli.test.ts / contamination-scan-cli.test.ts / harness-ab-cli.test.ts through the exported routers (runMakaEvalCli, scan main(argv), launcher main()). 30.65s → 19.61s (−36%), spawns 43 → 9. Retained: bin wiring, executable footer + realpath guard, detached launcher / crash journal / credential-order contracts.

Surveyed and deliberately left alone: runtime-bootstrap.test.ts and the pi-tui-runner signal probes (real process lifecycle is the subject), pi-cli-json-transport.test.ts (already fake-child DI), runtime-policy-ab-cli.test.ts (single test is the representative subprocess; its main() is unexported and a 0.6s saving does not justify the production touch).

No production command behavior changes in either PR.