test: isolate CLI tests from cloud environment

[andrei-hasna]

Summary

• clear ambient cloud connection variables for local-store session CLI child processes
• pass temporary database paths explicitly in output CLI fixture setup
• preserve bun run test under a supported cloud-configured operator environment

Context

Follow-up to #70. That release PR merged at 9d120af129be9398cbbdcef66b62662050169b8b before its requested adversarial review completed. The exact declared test gate then exposed five environment-isolation failures. This PR contains only the focused remedy from reviewer Agathon's named NO_GO finding.

Verification

• staged secrets scan: exit 0, zero findings emitted
• git diff --cached --check: exit 0
• bun run typecheck: exit 0
• bun run test: exit 0, 627 pass / 0 fail

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #71 @ dd86538 — lens: correctness+security+gates, reviewer Kant (1 of 1)

Independent adversarial review of the exact candidate against origin/main 6ba11233f11f403e7031880c3438d3f54a5c1c74:

• Read the complete two-file merge delta (4 insertions, 2 deletions) and surrounding getDatabase, cloud-mode resolution, test helpers, and all session.test.ts helper call sites.
• Confirmed the release files are byte-identical to the base; this PR contains only the focused test-isolation remedy.
• Confirmed explicit getDatabase(dbPath) bypasses only the test database cloud guard after resetDatabase().
• Confirmed clearing both cloud variables in the session subprocess environment isolates the intended local CLI tests while preserving explicit per-call overrides.
• Verification exercised the path with ambient cloud URL/key variables set without exposing their values.
• bun run typecheck — exit 0.
• bun run test — exit 0; 627 pass, 0 fail, 2625 expect() calls across 53 files.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.