test(helpers): cover the spawn-failure fallbacks in the shared sandboxes

[hivecommons-hive]

Test Improvement

Adds tests/helpers-spawn-fallbacks.test.mjs, covering the eleven uncovered
sub-line regions in the three shared sandbox helpers:

• tests/helpers.mjs (runScriptWithFixtures) — status ?? 1,
  stdout ?? '', stderr ?? '' (L78-80) and the : null arm of the
  readBack ternary (L75).
• tests/helpers-fetch-mock.mjs (runScriptWithFetchMock) — the same
  three fallbacks (L103-105).
• tests/helpers-gh-sandbox.mjs (runWithGhStub) — process.env.PATH ?? ''
  when building the child's PATH (L88) and the same three fallbacks (L111-113).

spawnSync reports a failed spawn as status: null with stdout/stderr
undefined rather than throwing, so those fallbacks are the only thing
deciding what a harness failure looks like to every fixture-driven suite in
the repository — whether "the script under test failed" stays distinguishable
from "the harness could not start it", and whether null leaks into an
assertion instead of an empty string. None of them had ever executed.

The spawn is broken by removing PATH from the test process, which makes the
bare node lookup every helper performs fail with ENOENT. PATH is restored
in a finally, and an up-front assertion documents that the check requires
PATH to have been set; node --test runs the tests within a file
sequentially, so no sibling test observes the gap.

The fourth case pins readBack's documented contract — a path the script
deleted or never wrote comes back as null, which is how write-mode tests tell
no output apart from empty output.

Verification

TZ=UTC node tests/tools/coverage-report.mjs, before and after:

file	before (region)	after (region)
tests/helpers.mjs	77.78%	100.00%
tests/helpers-fetch-mock.mjs	76.92%	100.00%
tests/helpers-gh-sandbox.mjs	76.47%	100.00%
all files	93.34%	93.54%

npm run test:unit:coverage:check passes, and the new file is itself at 100%
region coverage. npx prettier --check is clean.

Scope

Touches only tests/helpers-spawn-fallbacks.test.mjs — no existing test, helper
or source file is modified. Deliberately disjoint from the open hold-gated PRs:
tests/helpers-import-sandbox.mjs is claimed by #678 and
tests/helpers-script-sandbox.mjs by #693, and neither those nor #674, #680,
#686, #688, #702, #706, #708, #719, #723 touch tests/helpers.mjs,
tests/helpers-fetch-mock.mjs, tests/helpers-gh-sandbox.mjs or
tests/helpers.test.mjs. tests/helpers-jsx.mjs L30 (the legacy
register(HOOKS_URL) arm, reachable only on Node < 22.15) is left uncovered and
is named as out of scope in the issue.

Related Issue

Closes #726

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.