Keep real HOME and SOCKET_* off npm/Bun kids

From /code-review high: the Bun redirect suite ran its bun fixture
installs under the cache sandbox's home but the CLI under the real
one, so a registry or scope in the developer's ~/.npmrc would make
the two disagree. The CLI now gets the stand-in HOME
(jvm_env::isolate_cli), as run_with_env gives every other suite.
Its --no-telemetry flag goes: hermetic::command already forces
telemetry off, and the flag would override a caller opting back in.

e2e_npm's npm installs now drop ambient SOCKET_* vars too
(hermetic::scrub_socket_vars), like the package-manager children of
the other converted suites.

Refs #823

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

crates/socket-patch-cli/tests/e2e_npm.rs

@@ -96,6 +96,7 @@ fn assert_run_ok(cwd: &Path, args: &[&str], context: &str) -> (String, String) {
 fn npm_run(cwd: &Path, args: &[&str]) {
     let mut cmd = Command::new("npm");
     cmd.args(args).current_dir(cwd);
+    hermetic::scrub_socket_vars(&mut cmd);
     cache_env::isolate(&mut cmd);
     let out = cmd.output().expect("failed to run npm");
     assert!(
@@ -345,6 +346,7 @@ fn test_npm_global_lifecycle() {
     ]);
     // `--prefix` is a flag, so it still decides where the package lands; the
     // sandbox only moves the download cache off the caller's home.
+    hermetic::scrub_socket_vars(&mut cmd);
     cache_env::isolate(&mut cmd);
     let out = cmd.output().expect("failed to run npm install -g");
     assert!(

crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs

@@ -300,19 +300,23 @@ fn bun_env(cwd: &Path, args: &[&str], cache_dir: &Path, env: &[(String, String)]
     cmd.output().expect("failed to run bun")
 }
 
-/// The real binary with `--no-telemetry` appended: nothing in this suite
-/// should ever post a telemetry event, mocked API or not.
+/// The real binary. `hermetic::command` forces telemetry off: nothing in
+/// this suite should ever post a telemetry event, mocked API or not.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
     run_socket_env(cwd, args, &[])
 }
 
 /// [`run_socket`] with extra env applied after the scrub: the hermetic
-/// `SOCKET_*` environment (`hermetic::command`) plus the bun suites' shared
-/// scrub of every other ambient bun / npm registry setting.
+/// `SOCKET_*` environment (`hermetic::command`), the bun suites' shared
+/// scrub of every other ambient bun / npm registry setting, and a stand-in
+/// `HOME` (`jvm_env::isolate_cli`). The `bun` fixture children run under the
+/// cache sandbox's home, so the CLI must not read the developer's real
+/// `~/.npmrc` either: a registry or scope there would make the two disagree.
 fn run_socket_env(cwd: &Path, args: &[&str], env: &[(String, String)]) -> (i32, String, String) {
     let mut cmd = hermetic::command(&binary());
-    cmd.args(args).arg("--no-telemetry").current_dir(cwd);
+    cmd.args(args).current_dir(cwd);
     cache_env::scrub_ambient_bun_tool_env(&mut cmd);
+    common::jvm_env::isolate_cli(&mut cmd);
     for (k, v) in env {
         cmd.env(k, v);
     }