fix(scripts): resolve the pw-session lock path without requiring HOME

`lock_root` dereferenced `$HOME` unconditionally, so under `set -u` the script
died with "HOME: unbound variable" in any environment that starts without it —
even when `PLAYWRIGHT_RESOURCE_LOCK_DIR` made HOME irrelevant. Surfaced by
running the suite under vitest's node environment, where `process.env` is
patched and spreading it does not carry HOME through to the child.

Resolve the lock path in order (explicit override, XDG_CACHE_HOME, HOME) and
fail with a clear message only when none of them is set. The test now names
PATH and HOME explicitly instead of spreading process.env.

scripts/pw-session.sh

@@ -45,8 +45,20 @@ EOF
 }
 
 playwright_cli="${PLAYWRIGHT_CLI_BIN:-playwright-cli}"
-lock_root="${XDG_CACHE_HOME:-$HOME/.cache}/bitsocial"
-lock_dir="${PLAYWRIGHT_RESOURCE_LOCK_DIR:-$lock_root/playwright-session.lock}"
+
+# Resolved in order so an explicit override never depends on HOME being set:
+# some sandboxes, CI runners, and test harnesses start without it.
+if [ -n "${PLAYWRIGHT_RESOURCE_LOCK_DIR:-}" ]; then
+  lock_dir="$PLAYWRIGHT_RESOURCE_LOCK_DIR"
+elif [ -n "${XDG_CACHE_HOME:-}" ]; then
+  lock_dir="$XDG_CACHE_HOME/bitsocial/playwright-session.lock"
+elif [ -n "${HOME:-}" ]; then
+  lock_dir="$HOME/.cache/bitsocial/playwright-session.lock"
+else
+  echo "pw-session: set HOME, XDG_CACHE_HOME, or PLAYWRIGHT_RESOURCE_LOCK_DIR so the lock has a home" >&2
+  exit 1
+fi
+
 owner_file="$lock_dir/owner"
 started_file="$lock_dir/started-at"
 workspace_file="$lock_dir/workspace"

scripts/pw-session.test.js

@@ -47,8 +47,11 @@ let tempDir;
 const run = (...args) => {
   const result = spawnSync(scriptPath, args, {
     encoding: 'utf8',
+    // PATH and HOME are named explicitly rather than relying on spreading
+    // process.env, which vitest patches per environment.
     env: {
-      ...process.env,
+      PATH: process.env.PATH,
+      HOME: process.env.HOME,
       PLAYWRIGHT_RESOURCE_LOCK_DIR: path.join(tempDir, 'slot.lock'),
       PLAYWRIGHT_CLI_BIN: path.join(tempDir, 'fake-playwright-cli'),
       PW_SESSION_POLL_SECONDS: '1',