Setup resolves its collaborators from process-global state #921

Two pieces of ambient state in the setup lane, found while walking the remaining inventory after #913.

Mutable static test seams in production code. SetupCommand.FacadeOverride and SetupCommand.ImportRunnerOverride exist only so tests can substitute the onboarding façade and the import runner. Both are process-global: every test that sets one has to reset it in a finally and carry a NotInParallel constraint, and a site that ignored its collaborator would still pass.

An assembly-wide environment reset standing in for spawn-boundary containment. ProfileOverridesGlobalSetup blanks KCAP_URL and KCAP_PROFILE for every test assembly. In-process nothing reads either variable except ProfileOverrides.FromEnvironment() at the three composition roots — every other mention in src/ writes them into a child's environment or reads them back out of such a dictionary. The real exposure is at the spawn boundary, where a child re-resolves them at its own root.

That reset also has a live consequence: it blanks the variable SkipUnlessLiveGateReady gates on, so every *MemoryIndexLiveCertTests class skips unconditionally, on every machine and in CI. Nine live certs have never run.

What it should look like

• The façade and the import runner arrive as injected collaborators, so ignoring one is a compile error rather than a silent pass.
• KcapProcess clears server selection for the child alongside the two directories it already pins, and the assembly-wide guard retires.