fix(tests): eliminate env mutex poison cascade (#1558)

* fix(tests): eliminate env mutex poison cascade and fix test flakiness

The shared ENV_MUTEX used by ~68 config tests would cascade a single
test panic into failures across every module. Replace all .unwrap() /
.expect() lock acquisitions with a poison-recovering lock_env() helper.
Consolidate rogue module-local ENV_LOCK instances (workspace, orchestrator,
bootstrap) onto the shared global mutex to prevent cross-module races.

Also fixes:
- gateway user_id fallback was hardcoded to "default" instead of owner_id
- test_ironclaw_env_path used LazyLock which is order-dependent

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* test(helpers): add regression test for lock_env poison recovery

Satisfies the regression-test-check CI gate by adding a test that
intentionally poisons ENV_MUTEX and verifies lock_env() recovers.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(ci): detect test changes inside #[cfg(test)] regions

The regression test check relied on git diff -W to expand context to
function boundaries, but git doesn't recognize Rust `mod tests {}` as a
function boundary. Changes to imports, helpers, or lock calls inside
test modules were invisible to the check.

Add a line-level fallback: for each changed .rs file, find where
#[cfg(test)] starts and check if any diff hunk targets a line at or
after that boundary. This catches edits anywhere inside test modules
regardless of git's language awareness.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix: address PR review feedback

- Clear ENV_MUTEX poison after regression test so it doesn't leave
  global state dirty for subsequent tests.
- Fix CI regression-test-check to match #[cfg(test)] only when followed
  by `mod` (the test module pattern), avoiding false positives from
  standalone #[cfg(test)] items like statics or functions.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

src/db/libsql/workspace.rs

@@ -1017,7 +1017,7 @@ mod tests {
 
     mod resolve_dimension {
         use super::*;
-        use crate::config::helpers::ENV_MUTEX;
+        use crate::config::helpers::lock_env;
 
         fn clear_embedding_env() {
             // SAFETY: called under ENV_MUTEX
@@ -1030,14 +1030,14 @@ mod tests {
 
         #[test]
         fn returns_none_when_disabled() {
-            let _guard = ENV_MUTEX.lock().expect("env mutex");
+            let _guard = lock_env();
             clear_embedding_env();
             assert!(resolve_embedding_dimension().is_none());
         }
 
         #[test]
         fn returns_explicit_dimension() {
-            let _guard = ENV_MUTEX.lock().expect("env mutex");
+            let _guard = lock_env();
             clear_embedding_env();
             // SAFETY: under ENV_MUTEX
             unsafe {
@@ -1053,7 +1053,7 @@ mod tests {
 
         #[test]
         fn infers_from_model() {
-            let _guard = ENV_MUTEX.lock().expect("env mutex");
+            let _guard = lock_env();
             clear_embedding_env();
             // SAFETY: under ENV_MUTEX
             unsafe {
@@ -1069,7 +1069,7 @@ mod tests {
 
         #[test]
         fn defaults_to_1536_for_unknown_model() {
-            let _guard = ENV_MUTEX.lock().expect("env mutex");
+            let _guard = lock_env();
             clear_embedding_env();
             // SAFETY: under ENV_MUTEX
             unsafe {