fix: keep local home paths and addresses out of the test fixtures

Three test-only spots had baked in the machine this repository was developed
on, and the repository is publicly readable, so they shipped that machine's
shape to anyone who cloned it:

  * the end-to-end embedding backend was pinned to a private LAN address;
    it is now read from DSH_SLOPO_E2E_API_BASE, defaulting to Ollama's own
    loopback address, so the machine running the suite supplies its own;
  * the real-slopo test resolved discovery from a hardcoded root home, which
    meant it could only ever run for one user — it resolves from the running
    user's home now, which is also the fix for everyone else;
  * the harness-slot contract tests read the global npm tree by absolute
    path; they go through this repository's own node_modules symlink, which
    is already relative to the checkout.

No user-facing behaviour changes: the test files are not in the published
package, and the default configuration was already free of machine-specific
values — every address, path and key defaults to empty and is resolved per
user at runtime.

test/plugin.test.js

@@ -477,7 +477,11 @@ test(
       sourceDir: join(repo, 'src'),
       embeddingModel: 'ollama/unclemusclez/jina-embeddings-v2-base-code:latest',
       embeddingDimensions: 768,
-      embeddingApiBase: 'http://10.50.1.2:11434',
+      // Where the real embedding backend lives is a property of the machine
+      // running the E2E suite, not of this repository, so it is read from the
+      // environment rather than committed. The default is Ollama's own
+      // loopback address.
+      embeddingApiBase: process.env.DSH_SLOPO_E2E_API_BASE ?? 'http://127.0.0.1:11434',
     })
     const tool = state.tools.get('slopo')