test(headless): run ordinary CLI command semantics in process

[UncertaintyDeterminesYou4ndMe]

Part of #2387 (Headless workspace; the CLI workspace landed separately as #2476 per the issue's separate-PR requirement).

Problem

Three Headless suites started a Node subprocess per assertion for scenarios that only exercise argument validation, task-run business logic, and report verdicts. cli.test.ts was the sharpest case: 11 tests, 20 subprocess launches, 21.8s — each launch paying the full module-graph load of the headless CLI to test semantics that runMakaEvalCli already exposes as an exported Promise<number> router.

Change

No production changes. Every conversion goes through an already-exported entry:

• cli.test.ts — 10 of 11 tests run through mapLegacyMakaHeadlessArgs + runMakaEvalCli, the same mapping and router the bin runs, with stdout/stderr captured at the process-stream seam and env overrides applied/restored around the call. The non-Headless-root test keeps the real bin route as the representative wiring contract (real exit code, stack-free stderr hygiene).
• contamination-scan-cli.test.ts — 13 of 14 tests call the script's exported main(argv), with the executable footer's contract mirrored exactly (thrown error → stderr + exit 2, verdict codes returned). The no-argument rejection keeps the real subprocess as representative coverage of the footer itself, including its realpath main-module guard. The --markdown test gains an explicit assert.equal(code, 0) that was previously implicit in execFileAsync not rejecting.
• harness-ab-cli.test.ts — the three pure pre-launch validation tests (unsupported composition, superseded 30-task pilot, 89-task profile fingerprint mismatch) call the exported main() with a scoped env. Every remaining execFileAsync in the file exercises the detached launcher, its crash-time journal, the run lock, or the credentials-only-after-validation order — contracts that need a real process and stay on one.
• New shared helper withCapturedProcessIo swaps and restores the process-wide stream writers; safe for the sequential node:test execution these files use.

Deliberately not converted

• runtime-policy-ab-cli.test.ts: its single test is the representative subprocess for run-runtime-policy-ab.mjs, whose main() is not exported — adding an export to shave 0.6s is a production touch the saving does not justify.
• pi-cli-json-transport.test.ts already uses an injected fake child; task-agent-controller/harbor-cell subprocesses are the behavior under test.

Retained process contracts

Suite	Real-subprocess coverage kept
cli.test.ts	bin wiring end to end: legacy mapping, exit code, stack-free stderr (1 test / 2 launches)
contamination-scan-cli.test.ts	executable footer: no-args → exit 2, realpath main-module guard (1 test)
harness-ab-cli.test.ts	detached launcher + crash journal + run lock + fail-closed credential order (6 tests)

Timing

node --test, same machine, warm build:

file	before	after	spawns
cli.test.js	21.79s	13.12s	20 → 2
contamination-scan-cli.test.js	1.05s	0.63s	14 → 1
harness-ab-cli.test.js	7.81s	5.86s	9 → 6
total	30.65s	19.61s (−36%)	43 → 9

The residual 13s in cli.test.js is dominated by one heavy-task journey (7.4s) whose cost is task-run business logic, not startup tax — visible now that the tax is gone.

69/69 tests pass across 3 consecutive rounds; typecheck, biome, and knip are clean (knip delta against baseline: run-contamination-scan.mjs moves from unused to used).

cc @Astro-Han

[UncertaintyDeterminesYou4ndMe]

GitHub never generated check suites for this branch (0 runs across create/reopen/force-push — a platform-side event delivery failure, not a CI config issue). Superseding with an identical PR from a fresh branch so CI can run.