test: isolate Accounts suite from live environments

[andrei-hasna]

Summary

• preload a hermetic test environment before Accounts modules resolve storage or tool homes
• make PostgreSQL integration non-discoverable and require the dedicated explicit launcher
• observe and block inherited HTTP, database, keychain, shell, supervisor, and tool side effects
• use portable native blockers, controlled ignored test roots, and failure-safe cleanup

Incident

A plain repository test run inherited live Accounts cloud configuration and attempted fixture profile writes. Nine historical temporary test profiles were removed without purge. This PR makes bare tests fail closed; the incident and remediation are tracked in Todos task 61827fe6-8f30-4de7-bddf-de2f9067bb7a.

Verification

• literal hostile-environment bun test: 331 passed, 1 platform skip, 0 failed
• randomized parallel suite: 331 passed, 1 skip, 0 failed
• external HTTP/PostgreSQL sentinels: zero unexpected connections
• deliberate failing PostgreSQL launcher: expected failure, zero residual test roots
• typecheck, build, diff-check, and gitleaks passed
• remote Accounts metadata unchanged; zero temporary profiles
• independent exact-head adversarial review: PASS, no P0-P3 findings

No package publication or runtime deployment is included.

[andrei-hasna]

Merge blocked by elevated-risk artifact #2 at the bounded repair-cycle cap. A SIGTERM probe leaves the PostgreSQL launcher child and its postgres-launch root alive, violating the frozen cleanup contract. This PR will not receive another repair loop or merge. Disposition: split the fail-closed bare-test/cloud isolation into a narrower PR with no long-lived launcher child; track signal-safe PostgreSQL orchestration separately.