test(gdu): constrain the fixture export write to tmp_path

[tzzs]

What changed

test_gdu_backend.py's fake_run() (the mocked gdu subprocess used by the captured-export regression test) wrote the simulated export to whatever path showed up in the parsed subprocess args:

out_file = args[args.index("-o") + 1]
...
with open(out_file, "w", encoding="utf-8") as fh:

It now resolves the path, asserts it stays inside the test's own tmp_path tree, and only then writes via the resolved Path:

out_file = Path(args[args.index("-o") + 1]).resolve()
if not out_file.is_relative_to(tmp_path.resolve()):
    raise AssertionError(f"fixture export escaped tmp_path: {out_file}")
...
out_file.write_text(json.dumps(export), encoding="utf-8")

Same fixture behavior, explicit containment. Defense-in-depth for a test helper, plus it satisfies repository security scanning that flags unvalidated dynamic paths passed to open().

Split out of #19 (where it originally rode along) so that PR stays a pure performance change.

Test plan

• tests/unit/test_gdu_backend.py collects and passes/skips exactly as on master (the affected test runs on Linux CI where the mocked subprocess path is exercised; on Windows runners it skips, unchanged).