fix: keep local home paths and addresses out of the test fixtures [skip release]

Three test-only spots had baked in the machine this repository was developed
on, and the repository is publicly readable, so they shipped that machine's
shape to anyone who cloned it:

  * the end-to-end embedding backend was pinned to a private LAN address;
    it is now read from DSH_SLOPO_E2E_API_BASE, defaulting to Ollama's own
    loopback address, so the machine running the suite supplies its own;
  * the real-slopo test resolved discovery from a hardcoded root home, which
    meant it could only ever run for one user — it resolves from the running
    user's home now, which is also the fix for everyone else;
  * the harness-slot contract tests read the global npm tree by absolute
    path; they go through this repository's own node_modules symlink, which
    is already relative to the checkout.

No user-facing behaviour changes and the published package never contained
the test files, so this push publishes nothing. The default configuration was
already free of machine-specific values: every address, path and key defaults
to empty and is resolved per user at runtime.

[skip release]

test/slopo.test.js

@@ -17,7 +17,7 @@ import {
   slopoCandidates,
   uvInstallArgs,
 } from '../lib/slopo.js'
-import { managedSlopoPath, resolveDshHome, workspaceKey, workspaceStateDir } from '../lib/paths.js'
+import { managedSlopoPath, resolveDshHome, userLocalSlopoPath, workspaceKey, workspaceStateDir } from '../lib/paths.js'
 
 test('findSlopo prefers the managed install over PATH', () => {
   const home = '/dsh'
@@ -152,26 +152,35 @@ test('workspace state lives under the harness home, not next to the code', () =>
   assert.match(workspaceStateDir('/dsh', '/repo'), /^\/dsh\/dsh-slopo\/workspaces\/repo-[0-9a-f]{8}$/)
 })
 
-test('the generated config is accepted by the real slopo', { skip: !existsSync(managedSlopoPath('/root/.dsh')) && !existsSync('/root/.local/bin/slopo') }, () => {
-  const binary = findSlopo('/root/.dsh')
-  assert.ok(binary, 'expected a slopo binary for this test')
-  const dir = mkdtempSync(join(tmpdir(), 'dsh-slopo-conf-'))
-  const configPath = join(dir, 'slopo.conf.yaml')
-  writeFileSync(
-    configPath,
-    renderSlopoConfig({
-      source_dir: dir,
-      db_file: join(dir, 'slopo.db'),
-      ignore_file: join(dir, 'slopo.ignore.txt'),
-      agent_log_file: join(dir, 'slopo.agent.log'),
-      embedding_model: 'ollama/example:latest',
-      embedding_dimensions: 768,
-      embedding_params: { api_base: 'http://127.0.0.1:11434' },
-      source_dir_exclude: ['**/test/**'],
-    }),
-  )
-  const out = execFileSync(binary, ['--config', configPath, 'show-config'], { encoding: 'utf8' })
-  assert.match(out, /embedding_model: ollama\/example:latest/)
-  assert.match(out, /embedding_dimensions: 768/)
-  assert.match(out, /api_base: http:\/\/127\.0\.0\.1:11434/)
-})
+test(
+  'the generated config is accepted by the real slopo',
+  {
+    // Discovery resolves from the RUNNING user's home, not from a committed
+    // absolute one: a hardcoded home directory only ever matched one machine,
+    // and it published that machine's layout to everyone else.
+    skip: !existsSync(managedSlopoPath(resolveDshHome())) && !existsSync(userLocalSlopoPath()),
+  },
+  () => {
+    const binary = findSlopo(resolveDshHome())
+    assert.ok(binary, 'expected a slopo binary for this test')
+    const dir = mkdtempSync(join(tmpdir(), 'dsh-slopo-conf-'))
+    const configPath = join(dir, 'slopo.conf.yaml')
+    writeFileSync(
+      configPath,
+      renderSlopoConfig({
+        source_dir: dir,
+        db_file: join(dir, 'slopo.db'),
+        ignore_file: join(dir, 'slopo.ignore.txt'),
+        agent_log_file: join(dir, 'slopo.agent.log'),
+        embedding_model: 'ollama/example:latest',
+        embedding_dimensions: 768,
+        embedding_params: { api_base: 'http://127.0.0.1:11434' },
+        source_dir_exclude: ['**/test/**'],
+      }),
+    )
+    const out = execFileSync(binary, ['--config', configPath, 'show-config'], { encoding: 'utf8' })
+    assert.match(out, /embedding_model: ollama\/example:latest/)
+    assert.match(out, /embedding_dimensions: 768/)
+    assert.match(out, /api_base: http:\/\/127\.0\.0\.1:11434/)
+  },
+)