test: fix macOS concurrent validation harness

[bobbanj]

Summary

Describe the problem, the authorized scope, and the result.

Security impact

• Invariants reviewed:
• Threat-model entries reviewed:
• Trust boundaries affected:
• Public API or compatibility impact:

Validation

List exact commands and results. Include positive and negative tests when
security behavior changes.

Checklist

• The change is limited to one approved scope.
• Model-controlled content cannot create or broaden authority.
• Unknown, missing, stale, malformed, and unverifiable inputs fail closed.
• Validation, Consumption, and Execution remain separate.
• Every applicable security invariant has negative coverage.
• Public API and migration effects are documented.
• The complete test, formatter, and structural-check suite passes.
• No secrets, credentials, customer data, or raw prompts are included.
• Unrelated worktree changes are excluded.

Security vulnerabilities must follow SECURITY.md and must not
be disclosed in a pull request.