## Summary

Second independent extraction from #655. **One file, 11 additions.**
Based directly on `main`; it does not depend on the SDK update in #676
or on any subagent code.

Codex integration fixtures can download plugins containing their own
tests under `tmp/`. Vitest's default repository-wide discovery can
collect those foreign tests. Scope discovery to the repository-owned
`src/__tests__/` and `scripts/` directories instead.

- Reuse `configDefaults.include`, preserving Vitest's supported
test/spec filename patterns rather than narrowing to `.test.ts`.
- Keep the release-tooling tests under `scripts/`.
- Use an ESM `.mjs` configuration, which does not introduce a root-level
TypeScript file outside the application's `rootDir: src`.
- Leave test implementations, skip behavior, command-line exclusions,
dependencies, and production code unchanged.

## Validation

Validated independently on `main` at `a77829f`, using its SDK **2.0.0**,
Codex **0.164.0**, and Vitest **5.0.5**:

- Controlled before/after discovery check using `vitest list --filesOnly
--json`:
- Default discovery included a temporary
`tmp/vitest-discovery-probe.spec.ts`.
- The new configuration excluded only that foreign file; every other
file was preserved.
- An owned `.spec.mjs` probe and `scripts/next-preview-version.test.mjs`
remained discoverable.
- Temporary probes were removed before running the suites and are not
part of this PR.
- `npm run typecheck`
- `npm test`: **1,879 passed**, 36 skipped, matching the unmodified
discovery run on the SDK extraction
- `npm run test:integration`: **7 passed**, with the real Codex
app-server and a local mock model
- `npm run build`
- `git diff --check`

No snapshots changed. The full live-model E2E suite and local
cross-platform bundling were not run for this config-only change.