fix(test): honor directory= URL param on core test runner

[bpamiri]

Summary

• Reads url.directory in vendor/wheels/tests/runner.cfm and passes it through to TestBox, guarded by an allowlist (wheels.tests.* or vendor.<pkg>.tests.*) since /wheels/core/tests is unauthenticated.
• Flips the "not honoured yet, tracks tests(runner): honor directory= URL param to scope TestBox bundles #2280" aside in digging-deeper/packages.mdx to working guidance and adds the per-package row to the filter table in testing/running-tests-locally.mdx.
• No changes to tools/test-local.sh — the issue author's concern that it "drops unmapped filters" was off; the case statement falls through and the filter is already appended as &directory=$FILTER. It's the server that was dropping the param.

Closes #2280.

Why the allowlist

The core test runner endpoint has no auth gate — it only exists safely because it's a dev-only surface. Without validation, url.directory would let anyone who reaches the endpoint drive arbitrary CFC compilation through whatever mappings happen to be registered. The regex pins the input to the two legitimate roots and silently falls back to the core default on anything else.

Verification (fresh LuCLI server in a worktree)

Scenario	URL	Result
No filter (baseline)	/wheels/core/tests?db=sqlite&format=json	3327 pass, 182 bundles, 24.2s
Scoped to model specs	&directory=wheels.tests.specs.model	803 pass, 32 bundles, 1.6s
Scoped to fake package	&directory=vendor.wheels-fake-pkg.tests	1 pass, 1 bundle, 6ms — bundle named vendor.wheels-fake-pkg.tests.FakeSpec
Allowlist reject	&directory=../../../etc	3327 pass — identical to baseline, bad input silently falls back

Regex unit-tested offline against 14 positive/negative cases (0 failures).

Follow-up (not in this PR)

Discovered while verifying: directory=wheels.tests.specs.model.postSpec (documented at running-tests-locally.mdx:99 as "filter to a single spec file") has always returned 0 bundles — TestBox's addDirectory() resolves the dot-path to a filesystem directory, so a trailing .cfc doesn't match. Pre-existing docs drift unrelated to #2280. Fix separately by either (a) removing the docs claim, or (b) adding url.bundles support to the core runner (the app runner at tests/runner.cfm:98-105 already does this).

Test plan

• CI green across the full engine × database matrix
• Spot-check bash tools/test-local.sh model locally — should finish in seconds, not ~25s
• Spot-check the two updated docs pages render correctly on the guides site preview

🤖 Generated with Claude Code