v0.5.6 — the public CI goes green

0.5.5 fixed two of the three things that broke the test chain on the public repository; the third was standing behind them. npm test stops at the first failure, so each repair only revealed the next — and this one was invisible to me for a second reason worth recording: I verified 0.5.5 by running the snapshot on a machine where Claude Desktop is installed. The CI runner has no MCP host at all.

• test/install-paths.mjs could never pass on Linux. Its fixtures build a fake HOME and write Claude Desktop's config into Library/Application Support/Claude — the macOS shape. On Linux the installer looks under ~/.config, found no host, exited 1, and took every suite behind it down. The fixture now resolves that path per platform, the way install.mjs does.
• The same fixtures could write into the person running them. A fake HOME is a complete boundary only on macOS; elsewhere the installer honours XDG_CONFIG_HOME and APPDATA, which on a developer machine point at the real user. The sandbox now names those too.

Measured both ways: 30/30 on macOS, 23 suites green in a Linux container.