fix: isolate scan tests from the developer's real ~/.polylane credentials

[boristane]

Problem

test/scan.test.ts › investigateScanRisks mocks globalThis.fetch and asserts exactly one call, but the request path runs real credential resolution, which reads ~/.polylane/credentials.json. On a machine with an expired/expiring stored OAuth token, the client fires a token-refresh fetch before the actual API request — two calls instead of one, so the test fails locally while passing in CI (which has no credentials file).

Fix

Test-only change: point HOME at a temp dir before importing the source modules (switching to dynamic imports, since src/config/paths.ts computes CONFIG_DIR from homedir() at module load), and clean it up in an after hook. This is the same isolation pattern test/signup.test.ts already uses.

Verification

• npm test: 183/183 pass (was 182/183 with an expired local token)
• npm run typecheck: clean

🤖 Generated with Claude Code

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

Test-only change isolating scan tests from real credentials, plus restoring the ws dependency that src/client/workspace-socket.ts already imports. No production code paths are altered; the ws restoration fixes a missing dependency, not a regression.

View the full analysis →

Dependency changes

Package	Change	Jump	Release age
@types/ws	added 8.18.1	—	16 months
ws	added 8.21.1	—	26 days

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed 262b6e3 for production impact.}