…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

…between tests (#1056)

`AccountsManager.deferInitialLoadCatalogsForTesting` is a process-wide mutable
static flag gating whether `AccountsManager.init` spawns its background
`loadCatalogs` Task. The test-safe value is `true` (no background work);
`PalaceTestSetup.bootstrap()` pins it `true` at bundle load. Tests that need the
background load opt IN by setting it `false` in their own setUp.

Two sites left it `false` after running, leaking the unsafe value to the next
test class — which then constructs a real `AccountsManager`, spawning the
1100+-library registry crawl that outlives the test and pollutes whatever runs
next:
  - `AppContainer._resetForTesting()` — runs after EVERY test via the
    singleton-reset observer; its final line set the flag false.
  - `AppContainerResetTests.tearDown()` — explicitly set it false "for
    production semantics."

Both now leave the flag at the test-safe `true`. This is the root cause behind
recurring CI flakes that blocked PRs #1052/#1053/#1054 (none of whose own diffs
were at fault):
  - AccountsManagerCancellationTests.testCancelBackgroundWork_onOptOutInstance
    _isSafeNoOp — opt-out handle non-nil (failed all 3 iterations)
  - CatalogCacheKeyAndIsolationTests — layout-engine-off-main crash
  - BookReturnCleverReauthTests — crash → ** TEST FAILED ** with 0 reported
    failures
  - TokenRefreshOnForeground / TokenRefreshAndRetryQueue — token/network bleed

Regression: AppContainerResetTests.testResetForTesting_disablesBackgroundLoad
Catalogs now asserts the flag is `true` post-reset (was asserting false) — the
mutation that reintroduces the leak fails it.

No production runtime change: the flag is only ever non-default inside an XCTest
process (initializer keys off XCTestConfigurationFilePath); `_resetForTesting()`
already early-returns outside XCTest.

Verified: AppContainerResetTests + AccountsManagerCancellationTests +
CatalogCacheKeyAndIsolationTests + TokenRefreshOnForegroundTests +
TokenRefreshAndRetryQueueTests + BookReturnCleverReauthTests run together →
41 tests, 0 failures, ** TEST SUCCEEDED **.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).