fix(harness): avoid Home lookup for project outputs

[U1oSun]

Summary

Resolve Home only when validating a Global output target, so verified Project-only results remain recordable when the process Home directory is unavailable. Existing file and scope-containment checks remain unchanged.

Why

• Issue/Story: No issue. GitHub issue creation is restricted for this repository; this is focused compatibility maintenance discovered while validating Project-scoped output recording.
• User or maintainer outcome: Project output validation no longer fails because of unrelated Global/Home state in restricted environments.

Traceability and Scope

• Spec/ADR, if applicable: docs/specs/2026-07-30-project-output-home-resolution.md
• Acceptance criteria addressed: AC-1 (Project-only output avoids Home), AC-2 (Global output resolves Home on demand), AC-3 (existing-file and workspace-containment guards remain in force).
• Canonical owners changed: scripts/harness-analysis/record-fix-output.mjs, test/task-loop-report.test.mjs, the behavior spec, and CHANGELOG.md.
• Explicit non-goals: No schema, CLI, result-consumption, or containment-policy changes; no test-only production API parameters.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
node --test --test-name-pattern="record-fix-output" test/task-loop-report.test.mjs	Passed 10/10
node --test test/task-loop-report.test.mjs	Passed 76/76
node --test test/doc-link-graph.test.mjs	Passed 6/6
npm test	Exited 0; retained the existing Windows symlink-permission skip
npm run pack:verify	Passed using an isolated temporary npm cache
git diff --check origin/main..HEAD	Passed

Manual or visual evidence: Temporarily restoring eager Home resolution made the new Project-only child-process regression fail with exit code 1. With this change, the Project-only case succeeds, while an unavailable Home still fails for Global output without modifying the report.

Risk and Recovery

• Compatibility and cross-platform impact: The change only defers os.homedir()/realpath() until a Global target is encountered. Existing canonical-path containment and file-existence checks are unchanged. Windows was tested locally; CI should confirm macOS and Linux.
• Package, plugin, schema, or generated-file impact: None. No dependency, schema, or generated routing changes; the observable compatibility change is recorded in CHANGELOG.md.
• Rollback or recovery path: Revert commit 0df03e7.
• Residual risk or unverified boundary: Local Node v22.17.0 and npm 10.9.2 are below the repository minimums, so CI must confirm the supported runtime matrix. Open PR feat(harness): support monorepo workspace topology #21 touches the same validation area and may require a rebase if it lands first.

AI Involvement

• Level: Assisted (Codex).
• Human review and validation: UIOSUN selected the contribution scope, verified the GitHub identity/fork and isolated-branch strategy, and reviewed the recorded local reproduction and test evidence.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.

[phodal]

Ready to merge. The implementation keeps the existing file and containment guards while resolving Home only for Global output. The spec and AC-1 through AC-3 match the diff. CI is green on Windows, macOS, and Linux; independent validation passed the focused tests (10/10), doc-link checks (6/6), full suite (915/915), and package verification.