docs(test): a bare vitest is isolated now, and the guards need the sandbox HOME

Merge-time fix for #660. CLAUDE.md and architecture-invariants still said a
raw npx vitest skips setup.ts, contradicting the updated Testing note: both
now say it resolves the root vitest.config.ts (and why that file must stay).
The architecture-invariants entry for safeRmHomeTree adds the sandbox-HOME
requirement (isSandboxedHome, TEST_HOME_PREFIX), the same rule for
isUnderTestHome, the route-harness assert and the 2026-10-10 incident.
CLAUDE.md's repo-root preamble lists vitest.config.ts with its reason, so a
tidy-up does not move it into config/ and reopen #640. The
assertSandboxedHome JSDoc no longer claims every route test is covered: only
the ones built on createRouteTestHarness are.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test/mocks/test-helpers.ts

@@ -61,7 +61,8 @@ export function isSandboxedHome(): boolean {
 
 /**
  * Throw unless the suite is running under `test/setup.ts`'s temp HOME. The shared route harness
- * calls this, so every route test refuses to start against a real `~/.codeman`.
+ * (`createRouteTestHarness`) calls this, so a route test built on it refuses to start against a real
+ * `~/.codeman`. A route test that builds its own app from `createMockRouteContext` is not covered.
  */
 export function assertSandboxedHome(what = 'this test'): void {
   if (!isSandboxedHome()) {