test: snapshot-bound scan tests fail on macOS (fake gbrain compares a realpath to an unresolved $HOME)

What fails

On macOS, three tests on main (01593aa6, v1.91.2.0) fail on every run. They're in test/gstack-memory-ingest.test.ts, under "requested secret scanning at the import boundary › snapshot-bound requested scans":

• does not stamp an append during fresh import
• does not stamp an append during resumed import
• keeps the no-scan import stamping contract unchanged

Each fails expect(result.status).toBe(0) with Received: 1.

Why

The fake gbrain the suite writes guards APPEND_DURING_IMPORT like this (line 71):

const path = realpathSync(process.env.APPEND_DURING_IMPORT);
if (!path.startsWith(process.env.HOME + '/')) process.exit(2);

The test HOME is a temp dir under os.tmpdir(). On macOS that's /var/folders/…/T, and /var is a symlink to /private/var. realpathSync resolves the symlink, the prefix check fails against the unresolved HOME, the fake import exits 2, and the ingest exits 1. On Linux CI, /tmp isn't a symlink, so the tests pass there. The fake gitleaks guards APPEND_DURING_SCAN the same way (line 118).

Reproduce (macOS 27.0, bun 1.4.2)

bun test test/gstack-memory-ingest.test.ts -t "snapshot-bound requested scans"                             # 20 pass, 3 fail
TMPDIR=$(realpath "$TMPDIR") bun test test/gstack-memory-ingest.test.ts -t "snapshot-bound requested scans" # 23 pass, 0 fail

Suggested fix

Resolve HOME on the other side of both comparisons (realpathSync is already imported in both fakes):

-    if (!path.startsWith(process.env.HOME + '/')) process.exit(2);
+    if (!path.startsWith(realpathSync(process.env.HOME) + '/')) process.exit(2);
-  if (!path.startsWith(process.env.HOME + '/')) process.exit(2);
+  if (!path.startsWith(realpathSync(process.env.HOME) + '/')) process.exit(2);

With that change and the default macOS TMPDIR, the block passes 23/23, and the whole file passes (88 pass, 5 skip, 0 fail).