chore(node-sdk): audit test-support and test

test-support/harness.mjs owns process, server, JSON, fixture, and plugin-runner helpers; provider helper files keep their APIs as thin wrappers. Guard fixtures write 0600 files and the CLI security test isolates XDG_CONFIG_HOME, so the suite passes on Linux.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

test/guard-template.test.mjs

@@ -26,6 +26,7 @@ async function createFixture(status) {
   await writeFile(
     path.join(agentDir, 'config.json'),
     JSON.stringify({ agent_id: AGENT_ID, base_url: `http://127.0.0.1:${address.port}` }),
+    { mode: 0o600 },
   );
 
   const scriptPath = path.join(homeDir, 'guard.cjs');
@@ -91,6 +92,7 @@ test('cached frozen status keeps the blocking exit code', async () => {
     await writeFile(
       path.join(fixture.homeDir, '.elydora', AGENT_ID, 'status-cache.json'),
       JSON.stringify({ status: 'frozen', cached_at: Date.now() }),
+      { mode: 0o600 },
     );
 
     const result = await runGuard(fixture.scriptPath, fixture.homeDir);