Test infra: mocking harness + $HOME isolation + publish coverage

[0xLeif]

Three related test-quality gaps:

• No mocking harness — every network/subprocess path (LLM HTTP, GitHub API, remote fetch, plugin install, work git flows) is untested.
• Tests inherit the real environment — cli_config_init_default can write a real ~/.config/fledge/config.toml and asserts nothing; doctor tests probe the network. Tests should set FLEDGE_CONFIG_DIR/HOME to a tempdir and stub the network.
• src/publish.rs test module is tautological — the only real test is an empty #[ignore] stub, leaving the GitHub publish path with zero coverage.

---

Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.

[0xLeif]

Partially addressed by #463, which shipped the $HOME-isolation subset (hardened cli_config_init_default to use a TempDir via FLEDGE_CONFIG_DIR with real assertions). Reopening to track the remaining scope: a reusable mocking harness for network/LLM calls and publish-flow isolation so those tests don't touch real remotes. (The PR's Closes #447 auto-closed the full issue prematurely.)