claude-memory: scope-report test lacks CLAUDE_CONFIG_DIR isolation and can write into the live config tree

[kyle-sexton]

Context

plugins/claude-memory/skills/stateless/scripts/scope-report.test.sh isolates HOME to a fixture (ISO_HOME) but never unsets or overrides an ambient CLAUDE_CONFIG_DIR for its main cases. The resolver it drives honors that variable first: plugins/claude-memory/skills/audit/scripts/resolve-memory-dir.sh:63 reads config_root="${CLAUDE_CONFIG_DIR:-$HOME/.claude}". In Case 4 (lines 70-81), the suite resolves MEM_DIR via the real resolver (line 74), then mkdir -p "$MEM_DIR" and writes fixture MEMORY.md and debugging.md there (lines 75-77). With an ambient CLAUDE_CONFIG_DIR pointing at the user's live config, the suite would create directories and write fixture memory files inside the user's real projects/ tree, violating the suite's read-only contract with the host machine (and potentially polluting real auto-memory). Only Case 6 (lines 101-109) sets CLAUDE_CONFIG_DIR explicitly.

Proposed work

• Add env -u CLAUDE_CONFIG_DIR (or an explicit CLAUDE_CONFIG_DIR="$ISO_HOME/.claude") to every resolver and script invocation in the suite outside Case 6, including the Case 4 MEM_DIR resolution.
• Optionally add a guard that aborts the suite if the resolved MEM_DIR is not under $TEST_TMPDIR.

Acceptance criteria

• Running the suite with CLAUDE_CONFIG_DIR exported to an arbitrary directory writes nothing outside the suite's temp dir.
• Case 4's resolved MEM_DIR is asserted (or guarded) to live under the test's isolated home/tmp tree.

References

• plugins/claude-memory/skills/stateless/scripts/scope-report.test.sh:70-81 (Case 4: resolve then write), :57-68 (Cases 2-3, same missing isolation), :101-109 (Case 6, the only explicit override)
• plugins/claude-memory/skills/audit/scripts/resolve-memory-dir.sh:63 (CLAUDE_CONFIG_DIR wins over HOME)
• Found by the batch-simplify sweep on branch claude/code-tidying-batch-simplify-s7ljbi; deliberately not fixed there because the sweep was behavior-preserving.