fix(producer): isolate regression harness temporary roots

[jrusso1020]

The regression harness deleted and recreated a predictable system-temp directory for every suite. That shared root flowed into planning, chunk output, compiled HTML and capture diagnostics, producing twelve CodeQL alerts. Allocate a private root per suite invocation and preserve the existing finally cleanup, failure-report ordering and --keep-temp output/event paths.

Two mocked stage tests also supplied literal shared temporary paths. Give them private fixture roots with cleanup; the capture frames child still starts absent, preserving the fixture's disk-preflight behavior. No downstream production write, debug-directory, plan/chunk-output or media contract changes.

Alert/source map (independently traced by Magi):

• fix(studio): adapt sidebar thumbnail container to composition aspect ratio #727, build: use proper topological ordering instead of sequential cli-last hack #343, docs: add skillx quick-start to README and introduction #344, feat(cli): add --lang and auto-infer phonemizer locale from voice prefix #351–ci: add workflow_dispatch trigger to publish workflow #354: harness root only.
• feat(capture): improve capture quality, clean CLAUDE.md, skill refinements #339–[Feature Request] Support for Reusable Components and Global Design Systems #340: harness root plus captureStreamingStage fixture.
• fix(skill): all file paths use capture/ subfolder prefix #345–feat: add design system , theme.json, reusable components, docs #347: harness root plus probeStage fixture.

Validation: 24 harness/routing tests, 12 capture tests and 41 probe tests pass. The new isolation regression fails against the old allocation mechanism. Producer typecheck and oxlint/oxfmt pass. Existing harness cleanup and keep-temp branches remain unchanged; full render regressions and CodeQL must pass before merge. No alert dismissals or query suppression.

[miguel-heygen]

Exact-head review at fdd759b51eea89e2275a04c9debe9201cbe65510, following the 12-alert source audit.

• packages/producer/src/regression-harness.ts:966-979 makes createRegressionTempRoot the single harness allocator. Every suite ID comes from a direct fixture-directory entry, so it is a safe prefix component; mkdtempSync gives concurrent runs distinct private roots without touching /tmp/hyperframes-tests/<id>.
• The existing runTestSuite lifecycle is unchanged after acquisition: failure details still save first, non-keepTemp removes exactly the minted root, and keepTemp retains/logs that same random path and returns its rendered output path. Update, unsupported-mode early return, compile failure, render failure, and normal completion all still reach the same finally.
• captureStreamingStage.test.ts:1-12,198-199,494-497,606-609 moves every #339/#340 secondary framesDir leg under one private test root with afterAll cleanup. The frames child intentionally remains absent until production code would create it; this preserves the minimal fixture's disk-preflight contract rather than preconditioning the test.
• probeStage.test.ts:1-10,245-246 similarly moves the #345-#347 secondary workDir leg under a private root. Its mocked writeCompiledArtifacts boundary is unchanged. The other fixed test literals are not sources in the mapped alerts and remain mock-only values.
• This closes every mapped source leg: #727/#343/#344/#351-#354 through the common root; #339/#340 through common + capture fixture; #345-#347 through common + probe fixture. JavaScript CodeQL completed successfully with zero PR alerts, so no new source surfaced. No downstream plan/chunk scratch, persistent output, debug, media, or query configuration changed.
• Exact CI confirms 24 harness/routing, 12 capture, and 41 probe tests pass; Producer unit, Build, Typecheck, runtime contract, lint/format, Windows render, and CodeQL are green. The isolation control proves repeated same-suite roots differ, are POSIX 0700, preserve the legacy sentinel, and deleting one cannot affect the other; it fails against the baseline allocator.

Fallow reconciliation: exactly four clone groups, all introduced:false, all pre-existing media-reconciliation scaffolds inside probeStage.test.ts (70 lines total). None includes the new private-root setup or isolation control; there are zero complexity/dead-code findings and no suppression/config change. No concern for this patch.

No blocking or follow-up findings. Required aggregate Test is still running and remains a merge gate.

Verdict: APPROVE
Reasoning: One private harness allocator plus two private mock-fixture roots cover all 12 audited source legs without changing persistent downstream contracts, and exact-head CodeQL confirms the source closure.

— Magi