chore(node-sdk): audit test-support and test

test-support/harness.mjs owns process, server, JSON, fixture, and plugin-runner helpers; provider helper files keep their APIs as thin wrappers. Guard fixtures write 0600 files and the CLI security test isolates XDG_CONFIG_HOME, so the suite passes on Linux.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

test/cli-security.test.mjs

@@ -18,6 +18,7 @@ async function runCli(args, homeDir) {
         ...process.env,
         HOME: homeDir,
         USERPROFILE: homeDir,
+        XDG_CONFIG_HOME: path.join(homeDir, '.config'),
       },
       stdio: ['ignore', 'pipe', 'pipe'],
     });