fix(bin): scrub inherited fleet-home overrides in the serial test lane

[zeeshaanahmad]

Summary

Fixes #3536.

bin/fm-test-run.sh's parallel worker subshell already unset FM_HOME and the other fleet-home overrides before running a test script, but the serial lane passed them straight through. A test script builds its own fleet home, so an inherited FM_HOME is a second, invisible input that can decide a verdict — bin/fm-arm-pretool-check.sh, for one, reads FM_HOME as a classification input (see #3534 / #3538). A script's outcome could then depend on which lane the runner happened to schedule it into, rather than only on its own behavior.

Changes

Note: bin/fm-test-run.sh has diverged from the commit this port is based on, so this is a re-implementation against the current structure rather than a direct cherry-pick. Current main routes every script execution — both lanes — through a shared run_script_bounded() helper, which the earlier structure did not have.

• Define the fleet-home override list once (FM_TEST_INHERITED_OVERRIDES), reused by both lanes.
• In run_script_bounded()'s serial branch (stream == 1), prefix the child bash invocation (and the fm_run_timed timeout wrapper's bash -c invocation) with env -u ... built from that list, so the scrub is scoped to the child process rather than the runner's own shell.
• Replace the parallel worker subshell's separate hand-written unset list with a reference to the same array, so the two lanes can't drift apart again.
• Add a regression test (test_fleet_home_overrides_are_scrubbed_in_both_lanes) that runs a fixture script in both lanes under every override exported and asserts neither lane lets any of them through, while confirming an unrelated variable still passes through untouched (so the scrub is proven targeted, not a blanket environment wipe).

Test plan

• bash tests/fm-test-run.test.sh passes with this change, including the new regression test.
• Confirmed the new regression test fails against the unpatched runner (the serial lane leaks FM_HOME into the child script) and passes once patched.
• bin/fm-lint.sh passes.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The shared array remains available in worker subshells, the serial env -u wrapper preserves command and timeout semantics, and the regression test exercises both execution lanes.

_{Reviews (1): Last reviewed commit: "fix(bin): scrub inherited fleet-home ove..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate:

HEAD 1c5cee79edf02555cfcc5abb5c8c2437ccb0b7b3 — MERGEABLE/UNSTABLE. Linked #3536. workflow-zero (bin/fm-test-run.sh, tests/fm-test-run.test.sh). Author not blocked. Security: clean (targeted env -u scrub of known override names; unrelated env still passes through per regression).

Attestation: MISSING — no head-bound no-mistakes attestation. NM 33658985494 approved/queued this pass (will fail body-compliance without attestation, same as siblings). CI 33658985315 approved this pass and queued.

Contract-class: restore — the parallel worker subshell on main already unsets the same fleet-home override list before running a test script. Serial lane leaked those into the child, so a script's verdict could depend on which lane scheduled it. Shared FM_TEST_INHERITED_OVERRIDES + serial env -u prefix + regression fixture restores the already-shipped isolation contract so both lanes match. Not a new unconfigured product path beyond making the broken half keep the promise the parallel half already kept.

VISION (per rule, evidence = fm-test-run.sh parallel unset on main + this diff):

1. One captain, one interface — aligns (runner/test infra only).
2. Authority is explicit and never inferred — aligns (no consent/autonomy change).
3. Scripts own the mechanics, agents own the judgment — aligns (deterministic env scrub in the test runner).
4. A restart is a non-event — aligns (no durable records).
5. Delegation with a spine — aligns (strengthens refusal of invisible second inputs into test verdicts).
6. The fleet outlives any vendor — aligns (lane-independent isolation).
7. Scope — aligns (validation belongs with no-mistakes/CI; this keeps the forge honest). Closing: aligns.

This is waiting on you (the author), not a captain decision. Please git push no-mistakes to bind attestation to HEAD. Fork workflows approved after diff review (run ids 33658985315, 33658985494). When attestation MATCH + NM/CI green, this restore can auto-merge.

workflow-approvals this pass: 33658985315, 33658985494