test(project): regression coverage for #312 — HOME-like config does not leak

[ricardoarz-dev]

Summary

Adds two regression tests in `internal/project/detect_test.go` that pin the contract `.engram/config.json` is a project/repo lock — never inherited from arbitrary ancestors. They cover the multi-agent shape reported in #312, where each agent's MCP server runs from its own cwd under a shared `$HOME` that contains `~/.engram/config.json`.

Tests-only PR — no behavior change. The actual fix that prevents `~/.engram/config.json` from contaminating arbitrary cwds is already in main (`detectFromConfig` only reads at the git-root or the input dir, never walking to ancestors). These tests blind-side regressions of that behavior.

Closes #312 if maintainers agree the issue is resolved by the existing fix + this regression coverage. Otherwise happy to keep iterating.

Why these specific tests

`TestDetectProjectFull_DoesNotInheritParentConfigOutsideGitRepo` already covers the immediate-parent + plain-child case. The two shapes added here match what #312 actually reproduces in real multi-agent deployments:

1. `TestDetectProjectFull_HomeLikeConfigDoesNotLeakIntoNestedGitRepo` — config at a HOME-like ancestor, cwd inside a git repo several levels below (e.g. `$HOME/repos/agent-b/src/pkg`). Asserts `SourceGitRoot` wins over the ancestor config; project resolves to the repo basename, not the HOME-level `project_name`.

2. `TestDetectProjectFull_HomeLikeConfigDoesNotLeakIntoDeeplyNestedNonGitCwd` — config at a HOME-like ancestor, cwd several levels below outside any git tree. Asserts `SourceDirBasename` of the leaf cwd, not the ancestor's `project_name`.

Both shapes are described in #312's reproduction ("3 agents (`agent-a`, `agent-b`, `agent-c`) each with own engram MCP" sharing `/root/.engram/config.json`).

Test plan

• `go test ./internal/project/` — passes (5.7s)
• `go build ./...` — clean
• New tests fail when `detectFromConfig` is altered to walk ancestors (verified locally by temporarily widening the lookup; both new tests fail with `HOME-like ancestor config leaked`, as expected)
• Existing `TestDetectProjectFull_*` tests continue to pass

Files changed

• `internal/project/detect_test.go` — +94 lines (two new test functions, no edits to existing tests)

Notes

• Scope kept tight per Alan's note on MCP server hardcodes ~/.engram/config.json project_name; --project flag, ENGRAM_PROJECT, ENGRAM_DATA_DIR, HOME all ignored #312 ("Keep the implementation tight and include regression coverage where behavior changes"). No production code touched.
• Followup option (out of scope here): a parallel test in `internal/mcp/mcp_test.go` that exercises the same shape end-to-end via `resolveWriteProject()`. Happy to add in a follow-up if useful — left out of this PR to keep the diff minimal.