test(memory-sync): sandbox the cross-machine profiles E2E test

[LanNguyenSi]

Task 112a0864: the cross-machine profiles E2E test loaded the real committed profiles, whose machine-absolute syncPaths sources made it (a) fail with EACCES on any machine whose home is not /Users/lannguyensi (the MacBook) and (b) silently read LIVE operational state on the mini — measured: real ~/.harness/machine-state and ~/.harness/frictions content (4878 bytes of live friction exports) copied verbatim into the test remote.

What changed

• The test derives per-machine config files that remap ONLY the two machine-absolute syncPaths sources (machine-state, frictions) into per-machine fake-HOME dirs inside the sandbox; every other profile field passes through verbatim. The env-var route (AGENT_MEMORY_SYNC_SYNC_PATHS) was measured NOT to work — resolveRunConfig merges loaded settings over env — so the config file is the injection point the loader genuinely honors.
• A containment guard fails loudly, pre-CLI, if any resolved syncPaths source escapes the sandbox; after the review round it also covers relative sources (resolved against the sandboxed rootDir) and — via a shared choke point in machineArgs — the rootDir/stateDir/remoteUrl arguments, whose real values are additionally rewritten out of the derived configs (defense in depth: the reviewer measured the derived configs still carried the operator's live memory dir and production bare repo verbatim).
• Cross-machine property still exercised end to end, both directions, via seeded owner files and a dedicated fresh-state probe pull (necessary, not paranoid: a machine's own push adopts the full remote tree as its local base without writing to disk, so a same-flow pull is vacuous — reviewer-confirmed at push.ts:172-176 / pull.ts:100-103, and the probe's assertions measurably fail on regression).
• Committed profiles byte-identical (they are live launchd operational config); no production code touched.

Verification

• Reviewer reproduced everything first-hand on the worst-case host (the mini): ~/.harness checksums byte-identical across ~20 suite runs, remap fidelity confirmed forensically (exactly two fields differ per profile), guard mutation fires pre-CLI in 16ms with the offending path named, falsifiability probes on the new assertions (each seed-drop fails exactly the corresponding assertion), CI-green-on-ubuntu explanation confirmed at config.ts:74-79.
• Review: accept_with_notes, 1 MEDIUM + 5 LOW, zero HIGH/CRITICAL; MEDIUM and three LOWs fixed in 50b5305 with verbatim negative controls (dropping --root-dir containment or injecting a relative escape fails before any CLI call). Sandbox-cleanup LOW deliberately left (pre-existing package-wide pattern); the suite-hang LOW is the separately tracked task c71de504, now enriched with the reviewer's 26-run interleaved attribution evidence.
• Test file 4/4; full package suite 138/138 with coverage gate met (95.14/77.01/93.55 vs 86/65/86); typecheck clean.